Here’s everything you need to know about the European Data Protection Board (EDPB) latest opinion on the ‘‘consent or pay’ models deployed by large online platforms. 👇
Background
- Irish Fine: Meta was fined 390 million euros by Ireland’s Data Protection Commission for issues related to its targeted advertising practices.
- Meta’s Implementation Attempt: Meta introduced the “pay or OK” model on its Facebook and Instagram platforms, requiring users to either consent to targeted advertising or pay.
- EDPB Binding Decision: In November 2023, the European Data Protection Board (EDPB) issued a binding decision that prohibited Meta’s targeted advertising practices across the European Economic Area, further intensifying scrutiny on how personal data is used in advertising.
- Request for Formal Position: In response to the developments and ongoing concerns, the Data Protection Authorities (DPAs) of the Netherlands, Norway, and Hamburg requested the EDPB to formally address the ‘consent or pay’ models, particularly those being implemented by major platforms like Meta.
- EDPB’s Significant Opinion: The EDPB released an extensive opinion on the ‘consent or pay’ models deployed by large online platforms, responding to the concerns raised by the DPAs.
The EDPB’s Opinion: Key Takeaways
According to the EDPB, if users are simply given the binary option to consent to the processing of their personal data for behavioral advertising purposes or to pay a charge, then these online platforms will typically be unable to meet the conditions for valid consent.
👉 The EDPB recommends that large online platforms should not solely rely on offering paid alternatives as the standard approach. They should consider providing an ‘equivalent alternative’ that does not require payment. If a fee is charged for accessing this alternative service, platforms must also offer another option that is free of charge.
Ideally, this free option would not include behavioral advertising; instead, it is suggested that it would include less intrusive types of advertising that process personal data in a minimum or nonexistent way.
This alternative must entail no processing for behavioural advertising purposes and may for example be a version of the service with a different form of advertising involving the processing of less (or no) personal data, e.g. contextual or general advertising or advertising based on topics the data subject selected from a list of topics of interests.
This recommendation is essential for guaranteeing that consent is legitimate and freely provided, preventing situations in which users feel pressured to give consent to data processing because there are no other viable options.
In essence, this could imply providing users with three options rather than the limited binary choice:
- Accept All: this includes also consenting to processing of data for behavioural advertising
- Accept with Non-Behavioral Advertising: Consent without behavioral tracking.
- Pay: Access with a fee without personal data being processed for for behavioural advertising purposes.
Assessing Valid Consent
The EDPB indicated that the following criteria ought to be considered when determining valid consent:
- Conditionality: Controllers need to make sure that all the requirements to freely given and valid consent are met. The legitimacy of consent on a case-by-case basis must be carried out.
- Detriment: Controllers cannot impose conditions that harm data subjects for not consenting, leading to restrictions of access to services, professional networks, or content.
- Imbalance of Power: Controllers must assess market dominance, lock-in effects, dependency levels, and audience characteristics to avoid power imbalances.
- Granularity: Data subjects should be able to give consent for distinct processing activities.
Future EDPB Actions
The EDPB intends to communicate with stakeholders while developing guidelines that handle “consent or pay” models in a more thorough manner. The purpose of this upcoming guidance is to make it clearer how online platforms can use these models while still abiding by the law.
We will be monitoring the issuance of these guidelines and will keep you updated once published.
Collect user consent in compliance with privacy regulations across multiple languages and legislations
Get started
