Meta’s ‘Consent or pay’ plan: Is it legal? The answer is unclear

Meta plans to offer EU Facebook and Instagram users a choice: Consent to behavioral advertising or pay a fee – between $14 and $17 per month, according to the Wall Street Journal.

Throughout 2023, Meta has been hopping between “legal bases”—justifications for processing personal data under the General Data Protection Regulation (GDPR) – following a decision by the Irish Data Protection Commission (DPC) back in January.

But would such a model be legal under the GDPR? The answer is unclear.

A brief history of Meta’s ‘legal basis’ issues

Meta used to rely on “consent” to process its users’ personal data for behavioral advertising purposes. But then came the GDPR, which included a stricter test for what “consent” really means.

After consulting with the Irish DPC, Meta switched to relying on “contract” in May 2018, claiming that users agreed to receive behavioral ads when they signed up to use Facebook or Instagram.

There was a long investigation into this legal basis switch, including an intervention by the European Data Protection Board (EDPB).

Then in January 2023, the Irish DPC told Meta to find a new legal basis (and fined the company €390 million for following its advice).

So Meta switched from “contract” to “legitimate interests” in March 2023, providing users with a long-winded form via which to opt out of behavioral ads.

But that approach was also challenged by both:

• The Norwegian Data Protection Authority (DPA), which ordered Meta to get consent from users in Norway—and is now fining the company around €87,000 daily for defying its order.
• The Court of Justice of the European Union (CJEU), in a July competition judgment known as “Bundeskartellamt”. We’ll come back to this case.

New EU legislation, the Digital Markets Act (DMA), also strengthens the case for consent, requiring Meta and other internet “gatekeepers” to enable users to “freely choose to opt-in” to certain types of behavioral ads.

In August, with the walls closing in, Meta announced plans to switch to consent.

But if “consent” means “consent or pay”, this further complicates Meta’s legal position.

Is this ‘consent’?

Is Meta’s planned “consent or pay” model likely to be legal under the GDPR?

The answer is unclear. Here’s a look at three important sources.

Consent in the GDPR

Here’s how the GDPR defines “consent”:

“‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”

So, consent is:

• Freely given
• Specific
• Informed
• Unambiguous
• Given by a clear, affirmative action

Further consent conditions arise elsewhere in the GDPR, including the following:

• People have the right to withdraw consent at any time.
• It must be as easy to withdraw consent as to give consent.

The GDPR’s recitals (non-binding explanations of the law) provide further insights into consent:

• Access to goods or services cannot be made conditional on consent.
• Refusing or withdrawing consent should not lead to any detriment.

CJEU: Clear but non-binding

Earlier we mentioned a July CJEU case known as “Bundeskartellamt” that influenced Meta’s decision to switch to a “consent or pay” model.

Essentially, the CJEU said that users of platforms like Facebook must be “free to refuse… to give their consent” to behavioral advertising “without being obliged to refrain entirely from using the service…”

Here’s the important part: The court said that “users are to be offered, if necessary for an appropriate fee” an “equivalent alternative” platform that does not involve behavioral advertising.

So the CJEU appears to think that charging for a tracking-free Facebook or Instagram would be acceptable.

But these remarks were made in “obiter”, meaning that the court was discussing them as a sort of “side issue”. As such, the CJEU could change its mind on this point.

EDPB: Conflicting guidance

The EDPB has produced guidance on consent which, while not legally binding, might also help us understand whether Meta’s “consent or pay” model would be legal under the GDPR.

In its Guidelines 05/2020, the EDPB makes some conflicting statements about whether controllers can force a paid option upon users who refuse consent, including:

• The user must not experience “significant negative consequences (e.g. substantial extra costs)” for refusing or withdrawing consent.
• The user must not incur “any costs” for refusing or withdrawing consent.

These two statements conflict.

• In the first case, a platform might be able to charge a small or reasonable fee to consent-refusers.
• In the second case, a platform would not be allowed to charge any fee—no matter how small.

As noted, the Wall Street Journal reports that Meta’s planned pricing is between $14 and $17 per month (between approximately £11.50 or €13.30 and £14 or €16).

If price is a factor, this fee might be deemed too high.

But data protection regulators do not have the power to set prices. And the CJEU tends not to get so specific.

Consent or pay: Yes or no?

If people refuse consent, is it legal under the GDPR to charge them a fee? The authorities are unclear.

However, Facebook and Instagram’s revenues rely almost entirely on Meta’s ability to track and target users. The company has spent millions in legal costs, all to avoid offering its users a simple “yes” or “no” choice.

For most websites, it’s much easier to get clear, unambiguous, and freely given consent where appropriate.