After being asked for an opinion by three European data protection authorities (the Norwegian, Dutch and Hamburg DPAs), the European Data Protection Board has examined the legality of ‘consent or pay’ models, where users are presented with a choice between consenting to the processing of their personal data for behavioral advertising purposes or paying a fee. In the opinion published on 17 April 2024 the EDPB has concluded that large online platforms need to make significant changes to their practices in order to ensure validity of consent. Here’s why they say this and what they think is the way to go.
In a “consent or pay” model, users often face a binary choice: either consent to data processing or pay to access the service. Large online platforms often have a dominant market position, which can create an imbalance of power between them and users. This imbalance can make it difficult for users to freely give consent without fear of negative consequences as users might feel compelled to consent to avoid payment, particularly if the service is essential or lacks a reasonable alternative.
Additionally, behavioral advertising typically involves complex data processing activities, making it challenging for platforms to provide granular and specific information about the purposes of data processing. Processing personal data for behavioral advertising is seldom considered necessary for the performance of a service or contract, and thus requiring such consent or alternatively a payment can be seen as disproportionate.
The EDPB’s concerns are primarily focused on large online platforms due to their market dominance and the complexity of their data processing practices. Smaller platforms may face fewer challenges in obtaining valid consent if they have a less dominant market position and engage in less complex data processing, although the EDPB also notes that the viability of offering paid alternatives without data processing could be more challenging for smaller platforms due to resource limitations and less diversified revenue streams.
In EDPB’s interpretation, the lawful use of ‘consent or pay’ models requires first and foremost ensuring valid consent is obtained, which means:
1. Consent must be freely given
- No Detriment for Not Consenting: Users cannot be subject to negative consequences for withholding consent or withdrawing existing consent, such as imposing fees that effectively deter users from exercising their choices.
- No Power Imbalance: Platforms must assess the power dynamics between themselves and users, considering factors such as market position, dependency on the service, and audience demographics. In cases of significant imbalance, consent can only be used in exceptional circumstances where the platform can demonstrate no adverse consequences for non-consenting users.
- Service Access without Non-Essential Processing: Platforms cannot condition service access on consent for processing that is not necessary for the service’s performance. They must provide an “equivalent alternative” that omits non-essential processing, such as behavioral advertising.
- Equivalent Alternative: The alternative must be genuinely equivalent to the original service, with the only difference being the absence of behavioral advertising processing.
- Appropriate Fee: If a fee is imposed for the “equivalent alternative,” it must not deter users from exercising their choice or nudge them towards consent. Platforms must consider the impact on data protection rights and explore less data-intensive alternatives.
2. Informed
Prior to obtaining consent, platforms must provide users with comprehensive and understandable information about the processing activities associated with each option.
3. Unambiguous
Platforms must design consent mechanisms that prevent deceptive patterns, ensuring users knowingly provide consent to specific processing activities.
4. Specific
Platforms must clearly define the purposes for which consent is sought. Consent for behavioral advertising cannot be bundled with other purposes unless users actively select them. Platforms must evaluate and document whether behavioral advertising requires separate consent for distinct processing purposes.
The EDPB has also emphasised that obtaining consent does not absolve large online platforms from complying with the other rules and principles provided by the GDPR.
If there’s a single paragraph you can read from this opinion, I think this is it:
180. The EDPB recalls that personal data cannot be considered as a tradeable commodity, and large online platforms should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy. Therefore, the offering of (only) a paid alternative to the service which includes processing for behavioural advertising purposes should not be the default way forward for controllers. On the contrary, when developing the alternative to the version of the service with behavioural advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee (e.g. including a different form of advertising that is not behavioural advertising).
Note: “large online platform” is a concept defined in this opinion, and it not related to the definitions under the Digital Services Act.
Access full opinion here.
