The European Data Protection Board (EDPB) on April 17 issued its long-awaited Opinion 08/2024 on the GDPR compliance of the “pay or consent” mode of using personal data for behavioral advertising, which has long been used by operators of major online platforms and online media providers.
Summary
The opinion was requested by Dutch, Norwegian, and German (Hamburg Heaths) supervisory authorities in order to ascertain whether the “pay or consent” models for behavioral advertising implemented by the major online platforms constitute valid and freely given consent, considering their dominant position also in relation to the judgment of the Court of Justice of the European Union in case C-252/21, Meta v. Bundeskartellamt.
According to the CJEU, users who refuse consent to specific processing operations (i.e., those for behavioral advertising) must be able to have an equivalent alternative without such operations (i.e., without behavioral advertising or with traditional, less intrusive forms of advertising), “if necessary for an appropriate fee.”
The opinion, therefore, concerns the scope of:
- “pay or consent” models; these models offer users a choice between consenting to the processing of their personal data to access an online service or paying a fee to access it without having their data used for advertising purposes.
- practiced by major online platforms
- for the use of personal data for behavioral advertising
In summary, “pay or consent” models are not prohibited in principle, but providers of large online platforms should offer users 3 distinct alternatives:
- Free access to services, against consent to process personal data for behavioral advertising purposes
- Paid access to the same services, without behavioral advertising and without use of personal data for further purposes other than what is necessary for the provision of the online service
- Free access to services without use of personal data for advertising purposes or with traditional, less intrusive advertising, e.g., with a form of advertising that involves the processing of less (or no) personal data, rather than just a paid option.
Although the opinion is limited to the scope specified above, many of the steps it contains regarding the validity of consent are generally applicable to cases in which consent is used as a legal basis in the context of “pay or consent” models; the EDPB itself provides for later action regarding the same “pay or consent” arrangements adopted, however, by smaller entities than the controllers of large online platforms. National guidelines issued by German (Hamburg), Austrian and French supervisory authorities already provide general criteria for “pay or consent” models mostly implemented by these smaller entities.
EDPB highlights the importance of meeting the GDPR requirements for valid consent, particularly in relation to the principle of accountability. Valid consent must be specific and represent a clear indication of the data subject’s wishes: in the ‘consent or pay’ model, the individual should be able to choose which purpose to consent to rather than being forced to give cumulative consent for different purposes.
The EDPB also provides clarification on withdrawal of consent and advises data controllers to carefully consider how often consent should be ‘updated’.
In conclusion, it is important to prevent personal data from becoming a tradable commodity and subjects from having to pay for data protection. Data controllers should carefully consider whether and how much to charge as a fee in the absence of consent for behavioral advertising.
