European Data Protection Board Goes There, Rules Against Meta’s ‘Pay or OK’ Model

The EDPB — the EU’s legislature of privacy authorities — adopted a draft opinion today determining that large online platforms can’t offer a “pay or okay” model as a strict binary and must also offer a third, free choice that doesn’t utilize personalized advertising.

Given which way the wind’s been blowing in the EU, this is not surprising, but make no mistake, this is a radical stance. From the EDPB’s draft ruling (PDF):

The offering of (only) a paid alternative to the service which includes processing for behavioural advertising purposes should not be the default way forward for controllers. When developing the alternative to the version of the service with behavioural advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee. If controllers choose to charge a fee for access to the ‘equivalent alternative’, controllers should consider also offering a further alternative, free of charge, without behavioural advertising, e.g. with a form of advertising involving the processing of less (or no) personal data. This is a particularly important factor in the assessment of certain criteria for valid consent under the GDPR. In most cases, whether a further alternative without behavioural advertising is offered by the controller, free of charge, will have a substantial impact on the assessment of the validity of consent, in particular with regard to the detriment aspect.

With respect to the requirements of the GDPR for valid consent, first of all, consent needs to be ‘freely given’. In order to avoid detriment that would exclude freely given consent, any fee imposed cannot be such as to effectively inhibit data subjects from making a free choice. Furthemore, detriment may arise where non-consenting data subjects do not pay a fee and thus face exclusion from the service, especially in cases where the service has a prominent role, or is decisive for participation in social life or access to professional networks, even more so in the presence of lock-in or network effects. As a result, detriment is likely to occur when large online platforms use a ‘consent or pay’ model to obtain consent for the processing.

Leave a Comment