With the opinion issued on April 17, 2024 (Opinion 08/2024), the European Data Protection Board (EPDB) rejected the “consent or pay” models employed by large online platforms, stating that the consent to the processing of personal data given by the users with the “accept or pay” choice could hardly be considered valid.
Consent or Pay models and behavioral advertising
The Dutch, German and Norwegian Privacy Authorities asked EDPB to give its opinion on the legitimacy of the option “consent or pay” imposed to users by the largeonline platforms.
By this practice the data controller, that is the platform, forces the user to choose between two options in order to be able to use the service:
- accept the processing of their personal data for one or more purposes, or
- pay a fee to access the service without providing personal data.
The case addressed by the EDPB focuses on the consent of the user – more or less aware – for behavioral advertising purposes, that is advertising based on the observation of the behavior of the user.
This type of observation happens mainly through the use of cookies (or other similar processing technologies) and implies the execution of several activities by the platform, such as the tracking of activities of the users during the browsing, the collection of personal data and their analysis for profiling purposes, the sharing of personal data with third parties (such as advertisers), even in order to show users personalized advertisement based on their profile and to analyze their interaction with the proposed ads.
For this reason, behavioral advertising is considered as a particular invasive form of advertising and, as such, is subjected to the specific cautions imposed by GDPR.
The opinion of EDPB
According to the EDPB, online platforms should offer users a real choice, while the actual “consent or pay” models only ask users to give a great quantity of their personal data, or to pay.
Therefore, the EDPB concludes, the majority of the users consent to the processing of their data only to be able to use the service, without being aware of the consequences of the choice made, first of all when the consent refers to behavioral advertising. This implies even the invalidity of the consent given by users.
On this topic, the EDPB recalls that, on the basis of the GDPT, the consent to the processing of personal data can be considered valid only when given by the interested party in a free, informed, specific and unambiguous way. The user could not express a free consent if they are afraid of suffering negative consequences by not giving the consent (as the exclusion from a certain service, the impossibility of accessing to professional networks or the risk to lose content or contacts).
For these reasons, the EDPB considers that it is not possible to obtain a valid consent through consent or pay models which only give the choice between the consent to the processing and the payment of a fee. There should be provided “equivalent alternatives”, that do not involve the payment of a fee.
Lastly, the EDPB pointed out that “personal data cannot be considered as a tradeable commodity, and controllers should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy”.
Ilaria Feriti