Are Consent or Pay Advertising Models Legal?
10th February 2025
Meta introduced a ‘consent or pay’ model for Facebook and Instagram in the EEA and Switzerland in November 2023. This has drawn a lot of attention from data protection authorities across Europe, including the ICO and the EDPB. Is consent or pay a legitimate business model under data protection laws?
Update: see our new blog on consent or pay in the UK here.
The Details
Meta introduced this model to users of Facebook and Meta in the EEA and Switzerland, asking users to pay a monthly fee of €9.99 (or €12.99 through app stores) to use these platforms ad-free. Asking users to pay for a premium, ad-free service is not unusual, but what sets this apart is that users would automatically consent to have their data processed for targeted advertising.
What is ‘Consent or Pay’?
Also known as ‘pay or okay’, consent or pay is a model whereby a business, in this case, a social media platform, gives users the option to pay for a premium ad-free version or use a free version with ads. The free version may require consent to process users’ data to serve them personalised advertising. But can this truly present a free choice for the user if they need to pay to avoid businesses using their data for advertising purposes?
Is Consent or Pay Legal?
Under the GDPR and other data protection laws, the consent or pay model in itself is not technically illegal. It does, however, raise concerns about whether consent to data processing is freely given in such cases. The law states that users should be able to give fully informed, unambiguous consent to their data being processed for advertising purposes and that this consent should be freely given. It could then be argued that by asking users to pay for a formerly free service or automatically consent to have their data processed in this way, they are being pressured into either paying money or consenting, in other words, a breach of the notion of power imbalance.
The EDPB said in April 2024 that large online platforms such as Facebook and Instagram could not obtain valid consent from users when only offering the binary choice of consenting to data processing or paying a fee. As such, Meta does not meet the requirements for valid consent under the GDPR with the consent or pay model. The EDPB goes on to say that personal data should not be seen as a tradable commodity and that the fundamental right to privacy should not come at a cost. (source: Simmons & Simmons)
Data protection authorities and Meta have clashed many times over personal data processing, especially within the context of behavioural advertising, i.e. displaying targeted ads based on user preferences informed by their web browsing activity and other data points. In 2022, the Irish Data Protection Commission (DPC) fined Meta €390 million for breaching the GDPR, saying they did not have a lawful basis for processing personal data for advertising. During this case, the CJEU stated that “users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations”. (source: SH Legal) Just a few months later, Meta rolled out their consent or pay model in Europe.
The EDPB’s Opinion on Consent or Pay
The EDPB’s news release of April 2024 asserts that while consent or pay models aren’t inherently against data protection laws when employed by ‘large online platforms’ they are not compliant with the EU GDPR as they do not meet the requirement of valid consent. They have not said at this point if Meta will face any penalties, but they do plan to develop further guidelines on consent or pay models. They also acknowledge that there is a potential imbalance of power between users of Meta platforms and Meta itself, placing the burden on Meta as the Controller to ensure compliance with data protection laws.
Will Consent or Pay Come to the UK?
Currently, there appear to be no plans for Meta to roll out the consent or pay model in the UK. The ICO has taken pre-emptive action and published an impact assessment on the subject of consent or pay, which is summarised below:
- Contrary to the EDPB, the ICO states that current data protection laws in the UK do not prohibit consent or pay models but must ensure that consent to data processing is freely given, specific, informed and unambiguous.
- They identify potential issues with consent or pay, including the risk of coercing users into consenting to their data being processed and the provision of alternative options.
- They emphasise that service providers with a position of power in the market are unlikely to ask for explicit consent, as few realistic alternative options provide the same user experience, thus leading to a potential imbalance of power.
- The ad-free and ad-funded versions of a platform should be identical apart from the ads, as offering more add-ons with the premium service means that it is not equivalent, providing more coercion for users to pay for the premium service.
- If platforms demand an unreasonably high fee for an ad-free experience, this also cannot be considered valid consent to data processing. They do not give an exact amount, but the service provider should give justification for the amount they demand.
- They provide guidance for organisations who want to implement consent or pay models and remain compliant with data protection laws, including consideration of a cost-benefit analysis of such a model.
It is particularly interesting to note that UK GDPR Recital 42 states:
“Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.”
The ICO in their guidance states: ‘it may still be possible to incentivise consent to some extent. There will usually be some benefit to consenting to processing. For example, if joining the retailer’s loyalty scheme comes with access to money-off vouchers, there is clearly some incentive to consent to marketing. The fact that this benefit is unavailable to those who don’t sign up does not amount to a detriment for refusal. However, you must be careful not to cross the line and unfairly penalise those who refuse consent.’ It is difficult to see how those who are not paying are being forced to consent!
The ICO plans to continue monitoring the use of consent or pay models and how they impact individuals and businesses, ensuring a balance between user’s right to privacy and potentially unnecessary burdens on businesses.
As technology advances and AI tools and other developments become more widely used, organisations will need to continue adapting their models to remain compliant with data protection regulations while retaining their competitive edge in the market.
Author: Mike Martin LLM
Mike is an information governance specialist and one of the founder Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.
Sources
The Information Commissioner’s Office
