The European Data Protection Board (“EDPB”) has adopted an Opinion (“EDPB Opinion”) on the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. The EDPB concludes that “in most cases”, the requirements of valid consent under the General Data Protection Regulation (“GDPR”), will not be met if users are only given a choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.

Background

Last year, following a request from the Norwegian Data Protection Authority, the EDPB adopted an urgent binding decision, imposing a ban on the processing of personal data by Meta for behavioural advertising on the legal bases of contract and legitimate interest, across the European Economic Area (“EEA”).  As a result of the EDPB’s decision, Meta announced that it planned to rely on consent as the legal basis for its behavioural advertising activities in respect of users in the EEA – using a subscription model where users who do not consent to share their personal data and receive targeted adverts will be charged a monthly fee. This so-called “consent or pay” model has already been the subject of significant debate among European data protection supervisory authorities and been the subject of complaints from privacy activists.

In response to Meta’s announcement, the Dutch, Norwegian & Hamburg Data Protection Authorities made an Article 64(2) GDPR request to the EDBP to issue an opinion on the circumstances and conditions ’consent or pay’ models relating to behavioural advertising can be implemented by large online platforms, in a way that constitutes valid, and in particular, freely given, consent.

EDPB Opinion

The EDPB has clarified that the scope of its Opinion is limited to the implementation by large online platforms of ‘consent or pay’ models, where users are asked to consent to processing for the purposes of behavioural advertising. The EDPB states that “large online platforms” may cover, but is not limited to, “very large online platforms” as defined under the EU Digital Services Act and “gatekeepers” as defined under the EU Digital Markets Act.

In its Opinion, the EDPB concludes that offering only “a paid alternative to the service which includes processing for behavioural advertising purposes should not be the default way forward for controllers”. Individuals should be provided with an ‘equivalent alternative’, that does not require payment of a fee. The EDPB further states that “if controllers choose to charge a fee for access to the ‘equivalent alternative’, controllers should consider also offering a further alternative, free of charge, without behavioural advertising” – the EDPB considers this “a particularly important factor in the assessment of certain criteria for valid consent under the GDPR”. Individuals must have a genuine free choice – any fee charged cannot make individuals feel compelled to consent.

The EDPB refers to the European Court of Justice (“CJEU”) decision in Meta vs Bundeskartellamt,  which considered whether consent given by the user of an online social network to the operator of such a network meets the requirements of valid consent under the GDPR, in particular the condition that consent must be freely given, where that operator holds a dominant position on the market for online social networks. In its Opinion, the EDPB confirms that, as set out in the Bundeskartellamt judgment, when assessing whether consent is “freely given”, controllers should take into account: “whether the data subject suffers detriment by not consenting or withdrawing consent; whether there is an imbalance of power between the data subject and the controller; whether consent is required to access goods or services, even though the processing is not necessary for the fulfilment of the contract (conditionality); and whether the data subject is able to consent to different processing operations (granularity)”.

In addition, the EDPB confirms that controllers should assess, on a case by case basis, whether imposing a fee for use of the service is appropriate and, if so, the amount of that fee. In particular, controllers should ensure that “the fee is not such as to inhibit data subjects from making a genuine choice in light of the requirements of valid consent and of the principles under Article 5 GDPR, in particular fairness”.

Conclusion

The EDPB Opinion provides some clarity in relation to ‘consent or pay’ models, however, it raises the question as to how online services will be paid for if large online service providers cannot harvest and monetise consumer data . Although the EDPB does not go as far as prohibiting the use of a “consent or pay” models for behavioural advertising purposes, stating only that these models will not satisfy the requirements of valid consent under the GDPR ‘in most cases’, it sets a very high bar.

It is clear that the ‘consent or pay’ model will continue to attract attention from regulators. In particular, although the decision is non-binding, it will be taken into account by the Irish Data Protection Commission, and the Dutch, Norwegian and Hamburg data protection authorities that referred the matter to the EDPB, as they continue to investigate the processing of personal data for behavioural advertising purposes by large online platforms. In the UK, the ICO has also recently launched a call for views on the use of “consent or pay” models; and in the EU, the European Commission has launched investigations against a number of large online service providers in relation to compliance with obligations under the Digital Markets Act, including in relation to Meta’s new “consent or pay” model.

Although the EDPB Opinion is limited to ‘large online platforms’, we expect further guidance for other online service providers. In its press release, the EDPB confirmed that it will also develop guidelines on ‘consent or pay’ models with a broader scope.