Update: How Consent or Pay Models Fit Within UK Data Protection Law

As online advertising becomes more complex and regulation tightens, organisations are exploring new ways to fund their content, leading to the rise of consent or pay models. You may have seen the option to consent to targeted advertising or pay a premium on some websites, which prompts the question: Is this compliant with data protection law? Surely it can’t be legal to charge people for opting out of targeted advertising? Let’s take a look at the legitimacy of consent or pay models, what the law says, and the ICO’s guidance on the topic.

What is a Consent or Pay Model?

A ‘consent or pay’ model gives people a choice between consenting to an organisation using their data for personalised advertising on its platform or paying a fee to avoid seeing personalised advertising while accessing it. An example of this could be a news website that offers the option to pay to read its articles or view targeted advertising and read them for free. There is, of course, always the third option, which is to do none of the above and walk away. 

Consent or pay models are often used by organisations that rely on advertising revenue, such as publishers or news outlets. By showing targeted advertising based on personal information, they are collecting and processing visitors’ personal data and, as such, are subject to the UK GDPR and other data protection laws.

Are Consent or Pay Models Compliant with Data Protection Law?

On the face of it, consent or pay sounds like it would be unlawful; after all, for consent to be valid, it must be given for an unambiguous purpose, some positive action must be taken, and crucially, the consent or permission must be ‘freely given’, in other words, individuals must be given a choice. However, on the flip side, commercial organisations have a right to conduct a lawful business, and the ICO acknowledges that companies cannot be expected to provide a service for free, especially when significant costs are involved in offering the service. It can therefore be argued that if certain criteria are fulfilled, a consent or pay model strikes a balance and complies with the UK data protection laws. It should be noted that EU regulators take a different stance on consent or pay models. 

The ICO has published guidance on consent or pay models that includes a framework to assess whether they comply with data protection laws. You can see the ICO’s full guidance on consent or pay models on their website, but here is an overview of their assessment criteria:

Power Imbalance

When assessing whether a consent or pay model is legal, organisations should consider whether there is a power imbalance between themselves and the individual. A power imbalance could arise where the organisation is a public authority, if they have an essential service that people rely on, or on their position in the market. If people cannot switch to a comparable service provider due to the organisation’s large market share, this too is considered a power imbalance.

There could also be a power imbalance where the user accessing their website is a vulnerable person, perhaps because of their age, disability or financial situation. If there is a power imbalance between the organisation and the individual, they should take additional steps to make sure that people’s choice between consenting to personalised advertising or paying to avoid it is a meaningful, freely made choice. 

Appropriate Fee

If organisations want to use a consent or pay model, they must set a reasonable fee for opting out of personalised advertising. If costs are too high, users are given no real choice and may feel pressured into agreeing to ads based on their personal data. It is the responsibility of the organisation to determine an appropriate fee and be able to demonstrate why the fee is appropriate. 

The ICO and the legislation do not give an exact figure when describing an ‘appropriate’ fee; however, the organisation is encouraged to think about its position in the market, its size, the amount of revenue it could make through personalised advertising, and the nature of its data processing activities when setting the amount.

Equivalence

This means that regardless of whether people choose to consent to targeted advertising or pay the fee, the service or product they receive should be essentially the same. If either option offers a lower quality version of the core product or service, the same product/service with other significant differences resulting in a worse service overall, or a different service altogether, then they are failing to provide an equivalent service. Organisations should be able to demonstrate that both the consent and pay options provide the same core product or service.

Privacy by Design

Consent or pay models must be designed in a way that respects people’s rights from the outset. Website visitors must have a clear and understandable explanation of what the options are, what they mean regarding processing personal data, and how individuals can exercise their data protection rights. Withdrawal of consent should also be simple and easily accessible, and ideally, use the same method they originally used to give their consent. Performing a DPIA on your processing activity for a consent or pay model is recommended for identifying and mitigating any risks. 

Consent or pay models are not unlawful by default, but they require careful design, transparent communication and a genuine respect for user choice. Organisations considering this approach should follow the ICO’s guidance closely and ensure their model is fair, balanced and rooted in valid consent. If you have questions about the consent or pay model and how to apply it to your website in a way that is compliant with data protection law, contact us here at Griffin House Consultancy or call us on 01673 885533.

Author: Mike Martin LLM

Mike is an information rights law specialist and one of the founding Directors of the Griffin House Consultancy, a leading specialist data protection and information governance consultancy firm that supports hundreds of clients annually with their training, consulting and auditing requirements.