EDPB Calls for Fairer "Consent or Pay" Models in Online Advertising

On April 17, 2024, the European Data Protection Board (EDPB), during its latest plenary session, issued an Opinion following a request under Article 64(2) of the GDPR, by data protection authorities from the Netherlands, Norway, and Hamburg, on how l online platforms make use of the "consent or pay" models, pressing for enhanced transparency and fairness, n how personal data is handled, particularly in the realm of behavioral advertising. 

"Consent or pay" models are increasingly common nowadays, presenting users with a choice: allow the platform to use their personal data for targeted advertising, or pay a fee to use the service without such advertisements. This model has raised significant concerns about the validity of user consent under GDPR. In the official news report on the EDPB’s official website, Anu Talus, EDPB Chair, highlighted the issues with current practices saying that Online platforms should give users a real choice. The models we have today usually require individuals to either give away all their data or to pay. As a result, most users consent to the processing in order to use a service, and they do not understand the full implications of their choices.

In its current form, the EDPB asserts that these models often do not meet the strict requirements set forth by GDPR for valid consent, as they do not offer a genuinely free choice. Consent obtained under the pressure of either paying a fee or forfeiting personal data does not constitute the freely given consent outlined in GDPR.

As a recommendation, the EDPB has suggested that rather than sticking to a binary model, online platforms should strive to offer a third option—an "equivalent alternative" that involves neither fees nor extensive data processing. This could involve less invasive forms of advertising that do not depend on the extensive collection and processing of personal data.

In addition to this, the EDPB also reminded controllers that obtaining consent does not exempt them from complying with other GDPR principles, such as data minimization, purpose limitation, and fairness. Additionally, the board outlined several criterias to assess whether consent is genuinely free, including evaluating any imbalance of power between the user and the controller, and the potential detriment to users who opt not to consent.

Looking forward, the EDPB plans to develop comprehensive guidelines on "consent or pay" models. The board will engage with stakeholders to ensure these guidelines robustly protect user privacy without encumbering access to services. Chair Anu Talus emphasized the critical nature of these guidelines saying that 

Controllers should take care at all times to avoid transforming the fundamental right to data protection into a feature that individuals have to pay to enjoy. Individuals should be made fully aware of the value and the consequences of their choices.

As the EDPB moves forward with these initiatives, the message is clear: the right to data protection should never be a premium feature but a fundamental right accessible to all, regardless of financial capability. 

Here is a short summary of the Opinion of the EDPB: 

• Definition and Background: The "consent or pay" model is a practice where online platforms provide users with a choice to either consent to the processing of their personal data for targeted advertising or pay a fee to use the service without targeted ads. This model raises significant questions about compliance with the General Data Protection Regulation (GDPR).
• Legal Requirements for Consent: Under the GDPR, consent must be freely given, specific, informed, and unambiguous. However, the model of "consent or pay" often fails to meet these standards because the choice may not be genuinely free—if users must pay to avoid data processing, their consent to data processing could be seen as coerced.
• Data as a Commodity: The document criticizes the commodification of personal data inherent in the "consent or pay" models. It argues that privacy should not be something that users need to buy, as this undermines the principle that privacy is a fundamental right, not a luxury.
• Necessity of Real Choice: For consent to be valid, users must have real alternatives. This means platforms should ideally offer a genuinely free version that does not require data processing for advertising, alongside the paid version without ads and the version with ads based on consent.
• Equity and Accessibility: The document notes the importance of ensuring that all users, regardless of their financial situation, have access to services. This is particularly critical for essential services, where requiring payment for privacy could disproportionately affect those less able to afford such fees.
• Impact of Market Dominance: The document also considers the role of market power in these models. Platforms with significant market dominance might unfairly leverage their position to pressure users into consenting to data processing, as users have few realistic alternatives.
• Suggestions for Platforms: To better align with GDPR, platforms are encouraged to explore less invasive advertising techniques that do not rely on extensive personal data processing. These could include contextual advertising that does not require personal data.
• Case-by-Case Evaluation: Each implementation of the "consent or pay" model should be assessed individually, considering the specific circumstances and potential impacts on users' rights and freedoms.