Technology | Data privacy: EDPB publishes opinion on “consent or pay” models

The European Data Protection Board (EDPB) recently released its opinion on "consent or pay" models used by large online platforms. The opinion comes in the wake of Meta’s introduction of such a model, which has sparked debate regarding what constitutes valid consent under the GDPR.

In response to a request from Norwegian, Dutch, and German data protection authorities, the EDPB has expressed their view on the use of “consent or pay” or “pay or ok” models as grounds for behavioural advertising, most notably adopted by Meta. The model was adopted by Meta subsequent to a ruling from the CJEU that Meta could not rely on “contractual necessity” or “legitimate interest” as the legal basis for the processing of personal data for behavioural advertising.

The main question discussed in the EDPB’s opinion is the conditions for a consent to behavioural advertising to be “freely given”. The EDPB highlights some elements of the assessment:

Whether data subjects may suffer detriment as a consequence of not consenting or withdrawing consent
Imbalance of power between the platform and the data subjects
If consent is required to access the services (or if there is an “equivalent alternative”)
Whether any fee imposed is such as to inhibit data subjects from making a genuine choice

The EDPB’s opinion is that large online platforms are unlikely to meet the criteria that consent must be “freely given”, if users are presented with what the EDPB dubs a binary choice — consent to data processing for behavioural ads or pay a fee. The EDPB argues that large online platforms should offer users an “equivalent alternative” that does not involve payment. If a fee-based alternative is provided, platforms should also consider offering another option that is free of charge and without behavioural advertising, potentially using less or no personal data. According to the EDPB, such a “free alternative without behavioural advertising” may for example entail contextual or general advertising, or advertising based on topics chosen by the data subject.

The EDPB argues that data subjects may suffer detriment if they do not consent, as they may rely on large online platforms as sources of information and as part of their social lives. The EDPB even states that social media provides a “particularly valuable and convenient alternative to in-person interactions” and that not having access to them can have important consequences on some users’ emotional and psychological well-being. Furthermore, the EDPB highlights that data subjects may not have a genuine choice for professional or employment-oriented platforms, or platforms with “lock-in” effects due to users already having established a presence on the platform prior to “consent or pay” being introduced.

In its opinion, the EDPB states that personal data should not be viewed as a tradable commodity, as the right to data protection is a fundamental right. Data controllers are urged by the EDPB to ensure that the right to data protection is not made into a privilege that users must pay for.

BAHR’s view

The opinion issued by EDPB is not legally binding. Nevertheless, the opinion will serve as guidance for data protection authorities in their enforcement towards large online platforms. Parts of the opinion by the EDPB may be viewed as controversial. In particular, the emphasis on a free alternative without behavioural advertising, does not have a strong legal basis and may be challenged by data controllers if followed up on by data protection authorities.

From a Norwegian perspective, it is worth noting the impact of the Norwegian Data Protection Authority (Nw: Datatilsynet). Although the Norwegian Data Protection Authority does not have voting rights in the EDPB, it has still taken a role in shaping discussions on data protection at the European level, including this opinion from the EDPB.

A question to be considered is to what extent the EDPB’s view on large online platforms could affect similar solutions and paywalls for other online services, such as digital newspapers. It is important to note that the EDPB’s opinion does not advocate for a general ban on the use of “consent or pay” models, and many of the considerations highlighted in the EDPB’s opinion are not directly applicable to, for example, online newspapers. However, it is noted that all entities processing personal data must comply with all GDPR requirements, such as maintaining a lawful basis for processing and adhering to privacy principles. Therefore, individual evaluations must be conducted for each service or entity wishing to utilize “consent or pay” models.