Datatilsynet: Coop and Dagrofa used location data with no legal basis

Datatilsynet has closed inspections of the Coop and Meny shopping apps with serious criticism of how Coop Danmark and Dagrofa handled customer location dataDatatilsynet. In a news item dated 10 November 2026, the authority reports that it found both retailers had used location information from customers' mobile phones for their scan-and-pay functionsDatatilsynet without a lawful basis for processingDatatilsynet: that use required customer consentDatatilsynet.

Both companies had used the phones' built-in location data to identify which store a customer was in when using scan-and-pay. The processing was relatively limited — no continuous registration or tracking of customers' movements, only the information about the relevant store was used. Datatilsynet nevertheless assessed the use of phone location data as an intrusive processing of personal data requiring particular protection. Coop had relied on performance of a contractDatatilsynet and Dagrofa on the balancing-of-interests ruleDatatilsynet; the authority concluded neither basis could carry the processingDatatilsynet because it was not necessary to offer scan-and-payDatatilsynet. The stores could have identified the relevant shop in a less intrusive way, for example by having customers scan a QR code at the store entrance. Meny-appen's scan-and-pay function had already been phased out in October 2025.

Coop received further serious criticism for using phone location data for marketingDatatilsynet — showing content and marketing based on which store the customer was near, again invoking the balancing-of-interests ruleDatatilsynet. Datatilsynet weighed the protection of customers' location information more heavily than Coop's marketing interestDatatilsynet, noting that marketing could be done less intrusively, for instance by letting the customer choose a store manually in the app. That processing likewise required consent.Datatilsynet

Both companies were also criticised for their marketing consent solutions, for different reasons.Datatilsynet In the Coop app the "Accepter alle" button was highlighted in red while "Accepter valgte" was white, a design Datatilsynet found pushed users toward accepting all cookiesDatatilsynet and limited their free choiceDatatilsynet. In the Meny app users had to give a single bundled consent covering several distinct marketing purposesDatatilsynet, including disclosure of personal data to cooperation partnersDatatilsynet, with no option to select individual purposesDatatilsynet — and the consent text did not clearly state that data was shared with partnersDatatilsynet. Neither solution met the requirements for valid consentDatatilsynet: consent must be a freely given, specific and informed indication of wishes, given for each purpose, and design or bundling that removes the genuine choice fails that test.

Dagrofa received additional serious criticism for collecting information about user activity in the Meny appDatatilsynet through cookies and similar tracking technologies for statistics, improvements, error correction and competitions. Dagrofa had invoked the balancing-of-interests ruleDatatilsynet, but Datatilsynet held that tracking for purposes going beyond securing the app's functionality required consentDatatilsynet — particularly since users could not reasonably have expected the processing when the data was collected. Both companies have acknowledged the criticismDatatilsynet and started corrective measures, and Datatilsynet has asked each to account for the steps that will bring their processing into compliance with the data protection rules.Datatilsynet Legal basis: the contract and balancing-of-interests grounds the companies relied on are those of databeskyttelsesforordningen (forordning (EU) 2016/679) artikel 6, stk. 1, litra b og f, and the valid-consent requirement Datatilsynet applied is that of artikel 7.