EU regulators: ‘Consent or pay’ unlikely to be lawful among large online platforms

The European Data Protection Board (EDPB) has published an opinion on consent-or-pay models among “large online platforms”.

The opinion comes at the request of several EU regulators concerned about Meta’s recent policy of offering a version of Facebook and Instagram without behavioral advertising—but only where users pay a fee.

The EDPB suggests that Meta’s approach likely doesn’t meet the GDPR’s requirements around consent and behavioral advertising. Here’s a summary of the EDPB’s main arguments.

What’s a ‘large online platform’?

The EDPB focuses on “large online platforms” in this opinion (but a further opinion might provide broader guidance on this topic).

This term isn’t defined in law, but the EDPB says the following factors are relevant in determining whether a controller is a “large online platform”:

• Market position and impact: The platform should have a significant impact on the EU’s internal market, indicated by a substantial user base or market share.
• Scale of data processing: The platform likely conducts large-scale data processing activities, considering factors such as the number of data subjects concerned, the volume of data, and the range of different processing activities.
• Scope of influence: The platform may play a crucial role in societal functions, such as social or professional networking, or as an information source.
• Integration and network effects: The platform may have significant ‘lock-in’ effects where users are heavily reliant on its services and may find it difficult to switch to alternatives without considerable detriment.

The EDPB doesn’t confine its opinion to any particular company, but Meta’s Facebook and Instagram platforms are clearly within its scope.

Offering an equivalent alternative

The EDPB argues that, where a large online platform conducts behavioral advertising, it should offer users an “equivalent alternative” without behavioral advertising – but not “(only) a paid alternative”.

“When developing the alternative to the version of the service with behavioral advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee.”

The EDPB therefore cautions against providing a “binary choice” between behavioral advertising or paying a fee.

The “Alternative Without Behavioral Advertising”, as the EDPB calls it, can involve “a different form of advertising involving the processing of less (or no) personal data,” such as:

• Contextual advertising
• “General” advertising
• Advertising “based on topics the data subject selected from a list of topics of interests.”

Withdrawing or refusing consent ‘without detriment’

The EDPB emphasizes a statement in Recital 42 of the GDPR, and a general principle derived from the GDPR’s “consent” definition: Data subjects should not experience a “detriment” for withdrawing or refusing consent.

“The possibility to refuse or withdraw consent without detriment needs to be demonstrated by the controller,” the board claims.

The board argues that consent-or-pay models are incompatible with this principle, particularly in the context of large online platforms, as data subjects refusing or withdrawing consent will need to either pay a fee or stop using the service.

“If the data subject refuses to consent or withdraws consent, and does not pay the requested fee, they would not be able to use the service, which may constitute a detriment for the data subject,” the EPDB says.

This principle is particularly important where a service “has a prominent role, or is decisive for participation in social life or access to professional networks.” The board EDPB even suggests that losing access to a large online platform can affect a person’s well-being.

Freely given consent

The EDPB’s analysis rests on the GDPR’s strong definition of “consent,” particularly the “freely given” element.

“With respect to the requirements of the GDPR for valid consent, first of all, consent needs to be ‘freely given,’” the board notes.

The opinion discusses the notion of “conditionality,” namely “whether consent is required to access goods or services, even though the processing is not necessary for the fulfillment of the contract” – a factor that the GDPR states is relevant in assessing whether consent is ‘freely given’.

“Any element of compulsion, pressure, or inability to exercise free will, such as the requirement to consent as a condition for the provision of a service, constitutes coercion and is likely to make consent invalid,” the opinion notes.

In summary, the EDPB claims “it will not (usually) be possible for large online platforms to comply with the requirements for valid consent” via a binary consent-or-pay system.

Fundamental right to data protection

Finally, the EDPB notes that data protection is a fundamental right under the EU’s Charter of Fundamental Rights—and expresses concern that consent-or-pay models can infringe upon that right.

“Personal data cannot be considered as a tradeable commodity,” the board states. “Controllers should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy.”

However, the EDPB appears to have struggled to reconcile this view of data protection rights with a recent case known as “Bundeskartellamt,” in which the CJEU suggested that Meta could provide an “equivalent alternative” to Facebook without behavioral advertising, “if necessary for an appropriate fee.”

In light of this CJEU ruling, the EDPB’s opinion also seems to suggest that paying a fee does not, in itself, interfere with the right to data protection—unless the fee is too high.

“Any fee imposed cannot be such as to effectively inhibit data subjects from making a free choice.”

This somewhat confusing argument might need to be clarified at the CJEU – and such a clarification could occur within the next few years, depending on the next steps of the Irish Data Protection Commission (DPC) and Meta.