The European Data Protection Board has issued a damning opinion on the “consent or pay” models deployed by large online platforms, most notably Meta’s Facebook and Instagram, saying that tech firms must not transform “the fundamental right to data protection into a feature that individuals have to pay to enjoy”.
In what is likely to scupper firms which charge subscriptions to users so they are not tracked for advertising, EDPB chair Anu Talus said: “Online platforms should give users a real choice when employing ‘consent or pay’ models. The models we have today usually require individuals to either give away all their data or to pay. As a result most users consent to the processing in order to use a service, and they do not understand the full implications of their choices.”
The EDPB stated that, in most cases, it will not be possible for online platforms to comply with the requirements for valid consent, if they confront users only with a choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.
The regulator added that offering only a paid alternative to services which involve the processing of personal data for behavioural advertising purposes should not be the default way forward for controllers.
When developing alternatives, large online platforms should consider providing individuals with an ‘equivalent alternative’ that does not entail the payment of a fee. If controllers do opt to charge a fee for access to the ‘equivalent alternative’, they should give significant consideration to offering an additional alternative.
This free alternative should be without behavioural advertising, with a form of advertising involving the processing of less or no personal data. This is a particularly important factor in the assessment of valid consent under GDPR, the regulatory body stated.
The EDPB stresses that obtaining consent does not absolve the controller from adhering to all the principles outlined in Article 5 of GDPR, such as purpose limitation, data minimisation and fairness. In addition, large online platforms should also consider compliance with the principles of necessity and proportionality, and they are responsible for demonstrating that their processing is generally in line with GDPR.
As regards the need for consent to be free, the following criteria should be taken into account: conditionality, detriment, imbalance of power and granularity, the EDPB stated, adding that that any fee charged cannot make individuals feel compelled to consent.
The EDPB stated: “Controllers should assess, on a case-by-case basis, both whether a fee is appropriate at all and what amount is appropriate in the given circumstances. Large online platforms should also consider whether the decision not to consent may lead the individual to suffer negative consequences, such as exclusion from a prominent service, lack of access to professional networks, or risk of losing content or connections.”
The regulator notes that negative consequences are likely to occur when large online platforms use a ‘pay or consent’ model to obtain consent for the processing.
It continued: “Controllers also need to evaluate, on a case-by-case basis, whether there is an imbalance of power between the individual and the controller. The factors to be assessed include the position of the large online platforms in the market, the extent to which the individual relies on the service and the main audience of the service.
“Furthermore, the EDPB provides elements to assess the criteria of informed, specific and unambiguous consent that large online platforms should take into account when implementing ‘consent or pay’ models.
Anu Talus concluded: “Controllers should take care at all times to avoid transforming the fundamental right to data protection into a feature that individuals have to pay to enjoy. Individuals should be made fully aware of the value and the consequences of their choices.”
In addition to this Art. 64(2) Opinion, the EDPB will also develop guidelines on ‘pay or consent’ models with a broader scope and will engage with stakeholders on these upcoming guidelines.
Concerns over ad-free subscription services were first aired back in November, when the Max Schrems fronted privacy organisation NOYB filed a complaint with the Austrian data protection authority over Meta’s scheme for Facebook and Instagram.
In February, the organisation was joined by 27 other civil rights groups in calling for the EDPB to issue a binding opinion on the matter.
Meanwhile, last week, the European Commission’s opened an investigation into the scheme under its new Digital Markets Act. Brussels says it is concerned that the binary choice imposed by Meta’s model may not provide a real alternative in case users do not consent, thereby not achieving the objective of preventing the accumulation of personal data by tech giants.
While the UK is not involved because Meta’s subscription service is not available here, other companies are launching similar services and the UK’s Information Commissioner’s Office is currently consulting on the legality of the plans.
Related stories
Decision imminent on legality of Meta’s ‘pay or consent’
Tech giants under the cosh as Brussels enforces DMA
ICO yet to decide if ad-free subscriptions are unlawful
Meta hit by double whammy over ‘illegal’ data practices
Meta ad-free service faces data protection showdown
Meta subscription launch ‘not just about making money’
MailOnline waves white flag in ICO war on ad cookies
ICO: ‘Firms have 30 days to sort ad cookies – or else’
