buse among activists and lawyers attempting to circumvent democratic procedures. Unlike the U.S., which has been at the forefront of collective actions with its far-reaching class action regime, European states have traditionally been hesitant to adopt such an expansive and powerful redress mechanism. While great uncertainty exists as to the scope and potential impact of its private right of action, the immediate complaints pending in European courts highlight the potentially devastating roles that private actors may end up playing in GDPR enforcement.
Generally, individuals have two routes to vindicate an alleged infringement of their privacy rights under the GDPR. First, under Articles 77 and 78(2), they can lodge a complaint against the infringing company with a supervisory authority, and if the supervisory authority fails to conduct an investigation, the private actor can seek a judicial remedy against the supervisory authority. Second, under Articles 79 and 82, the private actor can seek a judicial remedy directly against the infringing company for damages. Additionally, Article 80(1) allows non-profit organization – like NYOB – to represent (and even receive compensation on behalf of) an individual, as long as the organization’s statutory objectives are in the public interest and the organization is active in the space of data rights.

In its complaints against Google, Instagram, Facebook, and WhatsApp, NOYB alleges that the companies’ privacy policies “forced” consent in violation of Article 4(11)’s enhanced requirement that consent be “freely given, specific, informed, and unambiguous.” NOYB claims that consent is illegitimate in situations where it is offered in a “take it or leave it” fashion because there is not a genuine choice to accept or decline without repercussion. For example, NOYB argues that consumers must either accept Google’s entire privacy policy and consent to all data processing or be denied access to the service entirely and give up access to their Gmail account, which is the default requirement to use Android phones and for signing into YouTube and several other Google Internet services.