by Judit Szalatkay
Shall I choose to pay a fee for Meta or shall I continue to use it for “free” and give my consent to personalized advertising? All of us have met this question if we are Facebook or Instagram users. And probably we have got the question in an inconvenient and bad timing. I wonder how many people have seriously considered the offer.
The ‘consent or pay’ model is not a new phenomenon. In 2021 a data protection organisation (noyb) filed complaints[1] to the Austrian and German data protection authorities against some German langue newspapers. They argued that under GDPR a consent to the processing of personal data for advertising purposes couldn’t be considered to freely given if otherwise a monthly fee (€8,90) would have been needed to pay.
The European Data Protection Board (EDPB) has recently published its opinion (opinion 8/2024)[2] which questions the validity of consenting to the processing of personal data on a legal basis when, instead of choosing to pay a fee, the sole other option is to accept online tracking for advertising purposes (‘consent or pay’ model). The EDPB has already stated in its guidelines 05/2020 that consent will not be valid if the data subject has no real choice: if they deny consent, they would face a significant negative consequence (e.g. substantial extra costs).[3]
Now – taking into account the European Court of Justice’s (ECJ) Meta-judgement[4] – the EDPB was requested to examine if the ‘consent or pay’ model relating to behavioural advertising can be implemented by large online platforms in a way that constitutes valid, and in particular freely given, consent. Behavioural advertising is a method in which ads tailored to someone’s browsing habits and other online behaviour such as pages visited (frequency, durability), products viewed or bought, clicks, user login information, communication content (posts, emails), site element interaction (content read or videos watched), and so on. It is one of the most extended and intrusive manner of personalising marketing activities.
Meta refers to the Meta-judgement that gave a green light when the ECJ said that the users must be free to refuse to give their consent to particular data processing operations without being obliged to refrain entirely from using the service, if an equivalent alternative is offered - if necessary, for an appropriate fee.[5]
Indeed, users can subscribe and pay a fee for Youtube or Spotify premium if they want to use an ad-free version. But there is a big distance between an ad-free option or an option where all the online activities of a person is followed and analysed in order to deliver personalized ads. And exactly this is what the EDPB says: there could be alternatives that do not involve payment of fees and do not involve consent to behavioural advertising (e.g. contextual or generic advertising using less personal data). It is true that data controllers are not obliged to provide services free of charge, but they must be able to prove that the choice was given without pressure . It is in line with the DMA which inter alia prohibits the gatekeepers’ data processing unless the end user has been presented with the specific choice and has given consent (taking into account the detailed rules of the GDPR). It says that gatekeepers should enable end users to freely choose to opt-in to such data processing and sign-in practices by offering a less personalised but equivalent alternative, and without making the use of the core platform service or certain functionalities thereof conditional upon the end user’s consent. [6] The ECJ in the Meta-judgement also stresses that it shall be assessed if the users of Facebook have validly and, in particular, freely given their consent to the processing at issue.[7]
The EDPB – in line with the ECJ’s findings in the Meta-judgement[8] – gives several additional aspects of evaluation the freedom of choice. Firstly, beside the fact whether any other option prevails in the realm of the platform given, it must be scrutinized if there any disadvantage that a user meets if they don’t give consent. Large social media services have become almost indispensable information channels. Due to network and lock-in effects, switching is often not a possibility, which can tip the balance in favour of platforms to the detriment of the consumers. Secondly, if a platform enjoys market dominance which causes a significant imbalance between the contractual parties, consent cannot be the right legal basis for data processing because realistically freedom of choice is only illusion. Furthermore, market dominance is not necessarily required to prove there is a lack of an alternative choice.[9] Then, another important consideration is whether or not payment of a fee would impede free choice and encourage contribution. Also, whether the fee could be considered to be disproportionate.
While paying €9,99 on browser or €12,99 on mobile app per month per account sounds quite convincing to accept tracking, from a consumer’s perspective. In fact, even a much smaller fee would have had the same effect. A study found that in a sample of 400 websites identified with cookie paywalls a monthly subscription-fee costs an average of €3,34, whereas the vast majority (67%) cost between €2 and €4 per month.[10] This amount doesn’t seem to be unreasonably high or disproportionate. Nevertheless, the sole fact that one must enter additional data such as payment details and other personal information can be deterrent because people generally don’t want to make the effort of filling out forms (such as a subscription), just as it can have a detrimental effect on privacy.
A study says that 99% of users tend to consent when facing paywalls.[11]
Bearing in mind the principle of fairness, a data controller, i.e. the platform has to assess, on a case-by-case basis, whether the fee is appropriate at all and if yes, what amount is acceptable. The fee should not prevent data subjects from refusing or compelling to give consent. The controller should be responsible for the fairness and correctness of its calculation on the basis of the principle of accountability. After this, the next question is which authority under which legislation can supervise that the price is not excessive.
Under GDPR – the EDPB says – where supervisory authorities find that consent has not been freely given or that the principle of accountability has not been respected, they may intervene and order corrective measures. The EDPB adds that data protection supervisory authorities should enforce the application of the GDPR, it cannot be outsourced, but it may be beneficial to consult consumer protection or competition authorities.[12] The Meta-judgement suggests that the terms of use, such as a subscription model can be examined under competition law as well. Also worth mentioning the DSA which states that very large online platforms (VLOPs) shall make risk assessment whether their terms and conditions under the aegis of the ‘consent or pay’ model would affect negatively the exercise of fundamental rights, among others, the right of privacy. When identifying negative effects, they shall put in place reasonable, proportionate and effective mitigation measures, tailored to the specific systemic risk. If they fail so, the European Commission can initiate a proceeding against them which could end up with fines.[13]
So we have a situation where privacy or consumer interests are at stake. There are several laws that regulate what is legal and what is not. Finally, there are several authorities that can claim the right to act and investigate, taking into account each other's procedures
It is to be welcomed that the EU is so active in the field of legislation, but as long as the law enforcement cannot catch up with the legislator's objectives, no real progress will be seen in protecting consumer (user) interests.
[1] https://noyb.eu/en/news-sites-readers-need-buy-back-their-own-data-exorbitant-price
[2] EDPB: Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms
[3] EDPB: Guidelines 05/2020 on consent under Regulation 2016/679, p. 24.
[4] C-252/21. Meta Platforms and others, Judgment of the Court of Justice, 4.07.2023.
[5] See Meta-judgement, p. 150.
[6] See DMA Article 5 and recital (36).
[7] See Meta-judgement p. 153.
[8] See Meta-judgement p. 140-154.
[9] In the Meta-judgement the ECJ says that the fact that the operator of an online social network, as controller, holds a dominant position on the social network market does not, as such, prevent the users of that social network from validly giving their consent, within the meaning of Article 4(11) of the GDPR, to the processing of their personal data by that operator. (p.147)
[10]V.Morel, V.Fredholm, C.Santos, A.Thunberg: Legitimate Interest is the New Consent - Large-Scale
Measurement and Legal Compliance of IAB Europe TCF Paywalls, 13.10.2023., http://arxiv.org/pdf/2309.11625
[11] T.Müller-Tribbensee, K.M.Miller, B.Skiera: Paying for Privacy: Pay-or-Tracking Walls, 05.03.2024.
[12] See footnote 2, par. 137-138.
[13] See Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act), Art. 34-35.
