On March 18, 2025, the Norwegian Consumer Council asked the Norwegian Supervisory Authority to investigate a payment app provider for using consumers’ purchase history for targeted advertising. 

The Council doubts that the consent obtained by the provider to “customize” its service is a valid legal basis under the GDPR.  In particular, it argues that consumers are not clearly informed about the use of their purchase history for targeted advertising and that the app’s user interface nudges consumers to consent.  It also claims that the app provider may be in breach of other GDPR principles, such as data minimization and purpose limitation.  According to the Council, the processing of purchase history reveals much information about consumers, such as the medications they take, their travel habits, their sexuality, or the political books they read, and therefore should not be used for advertising.

This action demonstrates once again that consumer regulators and associations are increasingly vigilant about consumer privacy and working with privacy regulators to take action.

*              *              *

The Covington team will continue to monitor developments in the area of targeted advertising, both from a privacy and consumer law perspective, and is happy to assist with any inquiries on this topic.