EDPB: Users need real choice in ‘consent or pay’ models
Brussels, 17 April 2024 - The EDPB issued an Opinion after receiving a request from the Dutch, Norwegian & Hamburg Data Protection Authorities (DPA) under Art. 64(2) GDPR. The Opinion examines the validity of consent for processing personal data for behavioral advertising purposes in ‘consent or pay’ models used by large online platforms.
EDPB Chair Anu Talus said: ”Online platforms should offer users a genuine choice when using ‘consent or pay’ models. The current models often force individuals to either give up all their data or to pay. As a result, most users agree to the processing to access a service, and they do not comprehend the full implications of their decisions.”
The EDPB states that, in most cases, ‘consent or pay’ models applied by large online platforms will not be able to meet the requirements for valid consent, if they only give users a choice between consenting to processing of personal data for behavioral advertising purposes and paying a fee.
The EDPB argues that providing only a paid option to services that involve processing personal data for behavioral advertising purposes should not be the normal way for controllers to operate. When creating alternatives, large online platforms should think about giving individuals an ‘equivalent alternative’ that does not require the payment of a fee. If controllers decide to charge a fee for access to the ‘equivalent alternative’, they should consider offering another alternative as well. This free alternative should be without behavioral advertising, e.g. with a type of advertising that involves processing less or no personal data. This is especially relevant in the assessment of valid consent under the GDPR.
The EDPB emphasizes that obtaining consent does not exempt the controller from complying with all the principles in Art. 5 GDPR, such as purpose limitation, data minimization and fairness. Moreover, large online platforms should also comply with the principles of necessity and proportionality, and they are accountable for showing that their processing is generally in line with the GDPR.
Regarding the requirement for consent to be free, the following criteria should be considered: conditionality, detriment, imbalance of power and granularity. For example, the EDPB indicates that any fee charged cannot make individuals feel obliged to consent. Controllers should evaluate, on a case-by-case basis, both whether a fee is suitable at all and what amount is suitable in the given circumstances. Large online platforms should also think about whether the decision not to consent may cause the individual to suffer negative consequences, such as exclusion from a popular service, lack of access to professional networks, or risk of losing content or connections. The EDPB notes that negative consequences are likely to happen when large online platforms use a ‘consent or pay’ model to obtain consent for the processing.
Controllers also need to assess, on a case-by-case basis, whether there is an imbalance of power between the individual and the controller. The factors to be assessed include the position of the large online platforms in the market, the extent to which the individual relies on the service and the main audience of the service.
Moreover, the EDPB provides elements to assess the criteria of informed, specific and unambiguous consent that large online platforms should take into account when using ‘consent or pay’ models.
EDPB Chair, Anu Talus added: "Controllers should always be careful not to turn the fundamental right to data protection into a feature that individuals have to pay to enjoy. Individuals should be fully informed of the value and the consequences of their choices.” In addition to this Art. 64(2) Opinion, the EDPB will also develop guidelines on ‘consent or pay’ models with a wider scope and will engage with stakeholders on these upcoming guidelines.