Consent and Personal Data: What Not to Do

By Gabriel Vargas and Mariano Wood, Covarrubias

Law 21.719 takes effect on December 1, 2026, and fundamentally transforms the personal data processing regime in Chile. Companies are already updating their privacy policies and terms of use. However, some are getting it wrong, and the cost of that negligence can be extraordinarily high.

The Trap of Conditioned Consent

Here's an illustrative example: the loyalty program of a major Chilean retail chain sends millions of users a notice explaining that, due to the new law, its terms and conditions have been updated. So far, reasonable. The problem lies in how it's communicated: the platform makes the continuity of accumulated benefits — points, discounts, savings — conditional on the user accepting the new data-processing terms. Confirmation is requested by email and through the points-management platform itself. The interface presents a single acceptance button, with no visible option to decline.

The implicit message is clear: accept, or lose what you've earned. This mechanism has a technical name under the new regulation: consent that has not been freely given.

What the Law Says

Article 12 of Law 21.719 requires that consent be free, informed, and specific. It also establishes a legal presumption: consent is presumed not to have been freely given when the data controller obtains it within the framework of a contract or the provision of a service for which that collection is not necessary. If the new data uses exceed what is strictly necessary to operate the benefits program, the presumption is triggered, and the burden of proving otherwise falls on the company.

Added to this is the purpose limitation principle: data collected for a specific purpose cannot be processed for a different purpose without new consent that, in turn, meets the same standards of freedom. If the updated terms introduce purposes that did not exist when the user enrolled in the program, a forced click is not enough to legitimize them.

The law does provide for an exception: the presumption of a lack of freedom does not apply when the only consideration required for the service is consent to process data. But in the case of a loyalty program tied to a retail chain, the user is already paying — buying products, using services. This is not a model financed exclusively through data. The exception simply does not apply.

The Fines at Stake

The regulatory signal is unambiguous. For serious infractions — such as processing data without valid consent or for a purpose other than the one authorized — the fine can reach up to 10,000 UTM. For very serious infractions, up to 20,000 UTM. In the case of repeat offenses by a company that does not qualify as small-sized, the penalty can escalate to 2% or 4% of annual revenue from sales and services, depending on the severity. For a large-scale retail chain, this can translate into figures in the billions of pesos.

The Role of Preventive Legal Advice

What this type of case reveals is not bad faith, but a lack of specialized advice on designing consent mechanisms. The architecture of the interface, the wording of the notice, whether or not an option to decline exists, and the granularity of the purposes disclosed — all of that is legal work, not merely design or marketing.

The new law does not prohibit updating terms or requesting new consent. What it penalizes is doing so in a way that leaves the data subject with no real alternative. Designing a consent flow that complies with the law is not more expensive; it simply requires specialized advice before the notice reaches the user — not after the Data Protection Agency opens an enforcement proceeding.