Court case paves way for Meta 'consent or pay' in the UK

Meta is considering launching its controversial ad-free subscription service in the UK, despite the scheme being under investigation in the EU, following an out of court settlement at the High Court in London over its use of personalised ads.

The case, which was launched in 2022 by technology and human rights campaigner Tanya O’Carroll, centred around how Meta collects users’ personal profiling data on Facebook and Instagram to target ads without offering an opt-out.

O’Carroll insisted the company is breaching data protection law – currently the UK GDPR – because it will not let her opt out of the profiling it uses to sell ads.

Her claim has been backed by the Information Commissioner’s Office, which has said users should have an opt out from their data being used to create targeted ads. It said: “Organisations must respect people’s choices about how their data is used. This means giving users a clear way to opt out of their data being used in this way.”

On Friday, both sides settled the case out of court, with O’Carroll claiming a “victory” after Meta committed to stop using her personal data to target her with bespoke ads.

She said: “This is an individual settlement, but I believe its ramifications extend far beyond me. The key factor is the UK data protection authority has publicly stated that it will support people in the UK who wish to exercise their right to object to online targeted ads. I think that beyond the life of this case, the writing is on the wall for Meta – people want a choice on surveillance ads, and the right to object gives them exactly that.”

Meta said it “fundamentally” disagreed with O’Carroll’s claims and took its obligations under UK GDPR seriously. It added that it “exploring the option” of introducing the subscription service in the UK, meaning user pay a fee for an ad-free service. Meta added: “We will share further information in due course.”

Concerns over so-called “consent or pay” subscription services were first aired back in November 2023, when the Max Schrems-backed privacy organisation NOYB filed a complaint with the Austrian data protection authority after Meta pioneered the scheme in the EU for Facebook and Instagram users; other companies soon followed suit.

At the time, Schrems said: “Fundamental rights are usually available to everyone. There were times when [they] were reserved for the rich. It seems Meta wants to take us back more than 100 years. It’s neither smart nor legal – it’s just pitiful how Meta continues to ignore EU law.”

In April last year, the European Data Protection Board – the top governing body in the EU – ruled that the practice was in breach of GDPR, warning tech firms that they must not transform “the fundamental right to data protection into a feature that individuals have to pay to enjoy”.

Meanwhile, in July, the European Commission ruled the scheme was also in breach of the EU Digital Markets Act.

At the time, EU internal market commissioner Thierry Breton said: “Our view is that Meta’s ‘consent or pay’ business model is in breach of the DMA. The DMA is there to give back to the users the power to decide how their data is used and ensure innovative companies can compete on equal footing with tech giants on data access.”

Even so, Meta is still running the scheme as the protracted legal arguments continue.

And Meta will no doubt be bolstered by the ICO’s recent assertion that such subscription services are completely legal in the UK.

The ICO’s guidance, published in January, clarifies how organisations can deploy “consent or pay” models to give users “meaningful control” while supporting their economic viability. It includes a set of factors for organisations to assess their models against to demonstrate people can freely give their consent.

At the time, the regulator said: “If you are implementing a consent or pay model, you must make sure that you are able to demonstrate people have freely given their consent for personalised advertising. This guidance sets out a framework of factors that are important to consider when assessing whether your consent or pay model meets the standard of consent. This reflects and builds on existing UK GDPR standards and ICO guidance.

“You must document an assessment of your model as part of your data protection impact assessment (DPIA). Your assessment should consider the data protection principles set out in the UK GDPR as well as the factors in this guidance and other relevant ICO guidance.”