TV2 Média Csoport Zrt. – €25,000 Fine (Hungary, 2023)

The TV2 Media Group Ltd., the controller, is one of Hungary's largest content providers. It operates several TV channels and online streaming services and has two websites tv2play.hu and tenyek.hu. "Tenyek.hu" contains predominantly news content, while "tv2play.hu" focuses on various audiovisual media content. In 2021, they had between 1.6 million and 2.4 million monthly visitors and a net revenue of 49,000,000,000 HUF (approx. €127,000,000). Based on a "public interest notification" the Hungarian DPA started an ex officio investigation into the data processing of the websites. There was a concern that the controller did not provide data subjects with adequate information about the processing and that the consent management platform (CMP) on the websites did not collect the consent of data subjects in a transparent and clear manner. The investigation revealed a number of potential data protection deficits. The CMP of the controller offered data subject's with the possibility to give consent to cookies by clicking an "OK, continue" button. However, the only alternative was a "more options" button which redirected to a second level of the CMP with more information and more detailed consent options. On this second level of the CMP, users were provided with two tabs for different categories of processing. On one tab, the user was able to give "consent" to different processing purposes. The other tab was titled "legitimate interest" and allowed the data subjects to object to data processing. Confusingly, the processes listed in both tabs was almost completely identical. They included purposes such as "selection of basic ads", "Measuring ad performance", and "creating a personalized advertising profile". The processing purposes ""storing and/or accessing information stored on the device"" was only listed under the consent tab. Regarding the meaning of "legitimate interest" the controller explained that, the way in which it is used on the website, the term would no