Is ‘consent or pay’ OK? The debate continues

Collecting personal data from internet users is getting harder. Faced with technical, social, and regulatory challenges, some online service providers are requiring their users to accept cookies or similar technologies – or pay a subscription fee to keep their data to themselves. 

This advertising model, known as “consent or pay”, has proved controversial – but appears to be gaining traction across the web, particularly among companies subject to the EU or UK General Data Protection Regulation (GDPR).  

This article explains why so many companies appear to be erecting “consent-or-paywalls”, and explores whether the model will last. 

Meta’s consent-or-pay saga

Early last year, Meta was ordered to stop relying on its Terms and Conditions to justify targeting its users with ads. A few months later, the company was also told it could not target ads on an “opt-out” basis. Since then, Meta has found itself at the center of the consent-or-pay debate. 

Meta resorted to consent-or-pay after those two preferred options – relying on the GDPR’s legal bases of “contract” or “legitimate interests” – were walled off by regulators, forcing the social media giant to get consent. 

But is “consent-or-pay consent” truly “consent” under the GDPR?

Meta’s financial incentive to continue collecting its users’ personal data explains the company’s reluctance to request consent by more conventional methods, such as offering a straightforward choice to “accept” or “reject” targeted ads. 

Meta hopes that its consent-or-pay policy will eventually be deemed legal by the courts. And it has some basis for believing that it will, thanks in part to a recent judgment from the Court of Justice of the European Union (CJEU). 

The Bundeskartellamt case

The potential legality of Meta’s consent-or-pay process was discussed in a CJEU case against the German competition authority, the “Bundeskartellamt”, in July 2023. 

While consent-or-pay was not the focus of the case, the CJEU said in passing that Meta could offer its users an “equivalent alternative” platform without targeted advertising “if necessary for an appropriate fee”. 

As Meta had recently been ordered to obtain consent for targeted ads, the company saw this CJEU judgment as justifying a consent-or-pay approach. 

In November 2023, Meta began offering its ad-free paid tier to Facebook and Instagram users across the European Economic Area (EEA). 

The European Data Protection Board (EDPB) Opinion 

In April 2024, the European Data Protection Board (EDPB) published an opinion on consent-or-pay models among “large online platforms”. 

While the opinion is not aimed directly at Meta, it sets out the EDPB’s view on whether consent-or-pay is legal for companies with a significant number of users and a strong market position. 

Analyzing the policy in terms of the GDPR’s consent rules, the EDPB concludes that consent-or-pay is unlikely to be legal for companies like Meta. 

The Board did not explicitly rule out charging a fee based on the extent of personal data processed by the provider, but emphasized that “…any fee imposed cannot be such as to effectively inhibit data subjects from making a free choice.” 

Meta has since lodged a challenge of the opinion before the CJEU. 

Is ‘consent or pay’ OK in the UK?

Meta has not yet implemented its “consent or pay” policy in the UK, where Facebook and Instagram users are governed by the company’s US entity and are still required to accept targeted advertising as a condition of using Meta’s services (under the legal basis of “contract”). 

However, some other providers have recently switched to a consent or pay model, and the UK’s data protection regulator is considered the legality of such a policy. 

The Information Commissioner’s Office’s (ICO) letter-writing campaign

Last November, UK’s data protection authority, the Information Commissioner’s Office (ICO), wrote to 53 of the UK’s top 100 websites asking them to change their cookie banners.  

The ICO’s letter said that cookie banners should offer users a straightforward choice to “accept” or “reject” cookies on the “first layer” – without the need to access a “settings” menu or take any other additional steps. 

On 31 January, the ICO reported that 38 of the 53 companies had since made the required changes. Some other companies were considering “other options” rather than immediately changing their cookie banner in-line with the regulator’s request. 

Since then, several of the UK’s most-visited websites have implemented “consent or pay”-style cookie banners. 

The ICO’s consent-or-pay consultation

In April 2024, the ICO opened a consultation to gather views on whether consent-or-pay is legal under UK law. 

The ICO said that “in principle, data protection law does not prohibit business models that involve ‘consent or pay’”.  

However, the consultation emphasizes that any consent-or-pay model must meet the UK GDPR’s definition of consent, meaning: 

• Users must have “a free choice about whether to receive personalized ads” 
• Controllers must not “deny access to a service unless users consent to personalized ads” 
• Consent must be “capable of being withdrawn without detriment” 

As of early September 2024, the consultation remains open—so whether the ICO believes such principles can co-exist with a consent-or-pay model remains to be seen. 

The future of ‘consent or pay’

While Meta continues to offer EEA users a tracking-free paid tier, smaller websites continue to adopt consent-or-pay policies across the UK and EU. 

Targeting digital ads is getting harder, given improvements in privacy technology, greater consumer awareness, and regulators taking a stricter line on cookie banners. Forcing users to “pay for privacy” might seem like the “least bad option” for some online services. 

But there’s another reason website operators might not wish to rely on “consent or pay”. 

On 5 September 2024, the EDPB invited “stakeholders” to participate in a call-for-views session about “upcoming guidelines on the application of data protection legislation in the context of ‘Consent or Pay’ models.” 

While the EDPB’s April opinion applied only to “large online platforms”, the Board will soon give its views on whether smaller operators can rely on the model. 

The EDPB effectively ruled out consent-or-pay for market-dominant companies like Meta. If the Board draws similar conclusions about smaller companies, consent-or-pay will become a much less viable model for generating advertising revenues.