On 17 April 2024, the European Data Protection Board (EDPB) adopted an Opinion on valid consent in the context of “consent or pay” models implemented by large online platforms following a request by the Dutch, Norwegian, and German Supervisory Data Protection Authorities.
In this Opinion, the EDPB established that “consent or pay” models “in most cases”, do not comply with the General Data Protection Regulation (GDPR) requirements for obtaining valid consent for processing personal data.
What are “consent or pay” models
“Consent or pay” models, also publicly known as “pay or OK” models, present data subjects with a choice between consenting to the processing of their personal data for a specific purpose or paying a fee to access an online platform without their data being used for that purpose.
The EDPB Opinion focuses on models where this choice belongs to the processing of personal data for behavioral advertising, particularly targeted ads, and where the controller involved is a large online platform.
Background
In January this year, the Dutch, Norwegian, and German (Hamburg) supervisory authorities requested the EDPB to issue an opinion based on Article 64(2) of the GDPR regarding in which circumstances and conditions “consent or pay” models relating to behavioral advertising can be implemented by large online platforms in a way that constitutes valid, and in particular freely given, consent.
Moreover, since there have been different approaches to the “consent or pay” practices throughout Europe –with some States allowing it while others do not–, and taking into account the judgment of the Court of Justice of the European Union (CJEU) ruling in Meta Platforms Inc and Others v Bundeskartellamt (C-252/21), an opinion was needed.
Key points of the Opinion
First of all, the EDPB Opinion highlights the need to comply with all the requirements of the GDPR, in particular those for valid consent, while assessing the specificities of each case. Obtaining consent does not absolve the controller from adhering to all the principles in Article 5 of the GDPR such as the principles of accountability, necessity and proportionality, purpose limitation, data minimization, and fairness.
Secondly, the EDPB states that “In most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.” The EDPB’s Chair, Anu Talus, stated “Online platforms should give users a real choice when employing ‘pay or consent’ models” […] “The models we have today usually require individuals to either give away all their data or to pay. As a result, most users consent to the processing in order to use a service, and they do not understand the full implications of their choices.”
It was then concluded that offering only a paid alternative to the service which includes processing for behavioral advertising purposes should not be the default way forward for controllers. When creating alternatives, large online platforms should consider providing data subjects with an “equivalent alternative” that does not entail the payment of a fee. This free alternative should be without behavioral advertising, e.g. with a form of advertising involving the processing of less or no personal data.
Therefore, for consent to be valid, the following criteria should be taken into account:
⦿ Conditionality: the EDPB notes that any fee imposed cannot make individuals feel compelled to consent. Controllers should evaluate, on a case-by-case basis, both whether a fee is appropriate at all and determine the appropriate amount considering the specific circumstances.
⦿ Detriment: Large online platforms should consider whether the decision not to consent may negatively affect a data subject’s ability to access a prominent service, their access to professional networks, or lose their access to content or followers. The EDPB established that negative consequences are likely to occur when large online platforms use a “consent or pay” model to obtain consent for the processing.
⦿ Imbalance of power: controllers also need to assess, on a case-by-case basis, whether there is an imbalance of power between the data subject and the controller. The position of the platform, the level of dependence of individuals, and the main audience of the service are to be considered.
⦿ Granularity: when presented with a “consent or pay” model, the individual should be able to choose freely the individual purposes of processing they accept, rather than being confronted with one consent request bundling several purposes.
Furthermore, the EDPB emphasizes that personal data cannot be considered a tradable commodity, and large online platforms should bear in mind the need to prevent the fundamental right to data protection from being transformed into a feature that individuals have to pay to enjoy.
All in all, the Opinion states that “consent or pay” models concerning behavioral advertising can only be valid if these platforms can prove that they fulfill all the requisites for valid consent.
The EDPB also announced that in the future it will develop guidelines on “consent or pay” models with a broader scope and intends to engage with stakeholders on these guidelines.
Implications
The EDPB Opinion provides crucial guidance in a domain of data protection law that has been under scrutiny since the GDPR’s introduction. It constitutes guidance for businesses and service providers operating within the European Union to ensure compliance with the GDPR and may help improve understanding of the legal and ethical considerations surrounding consent mechanisms in the context of commercial transactions.
It highlights the importance for large online platforms to ensure that the consent they obtain from users is free and that they follow the GDPR’s requirements and principles.
Moreover, the EDPB Opinion should be viewed in the context of the European Union’s broader Digital Services Act package, which aims to create a safer digital space where the fundamental rights of users are protected.
Criticism
Nevertheless, there has been criticism regarding the EDPB’s Opinion. Some believe that it is risky to target the Opinion at large online platforms and the fact that it would entail economic loss for businesses in the European Union.
The Computer and Communications Industry Association (CCIA Europe)’s Senior Policy Manager, Claudia Canelles Quaroni, expressed that “With an approach targeted predominantly at large online platforms, the EDPB risks opening a Pandora’s box. A two-speed data protection regime would set a dangerous precedent and directly contradicts the GDPR’s goal of a single, harmonized standard for data protection within the European Union. This would create confusion, reduce legal certainty for businesses, and ultimately weaken individuals’ rights.” […] “Forcing businesses to offer services at a loss is unprecedented and sends the wrong signals at a time when European leaders are looking to increase the bloc’s competitiveness. This would go against one of the basic principles of an open market economy and the freedom to conduct business. The notion that contextual advertising may be a suitable alternative for all businesses to generate revenue is unrealistic.”
Conclusion
The Opinion confirms that consent must be a genuine free choice. Users facing “consent or pay” models on large online platforms, and unable to pay, may suffer consequences, risking exclusion from essential services or information.
In conclusion, the Opinion highlights the importance of users’ genuine freedom of choice and the importance of accountability in obtaining valid consent. Data subjects may benefit from greater transparency and choice regarding their data privacy, while platforms may need to rethink their business models and consider alternative approaches to monetization that align with the GDPR’s principles. This way, platforms will prioritize users’ privacy rights in their practices.
