The European Data Protection Board (“EDPB”) has issued an Opinion on the “consent or pay” model implemented by large online platforms in which users are asked to consent to the processing of their personal data for the purpose of adapting the advertising offered on the basis of a series of user behaviour patterns when surfing the web (i.e. behavioural advertising) or, alternatively, to pay a fee to access the platforms without their personal data being subject to analysis (“Opinion”).

With this Opinion, the EDPB emphasises the need for data controllers to comply with all the requirements of the General Data Protection Regulation (“GDPR”), especially those related to the valid consent that users of large online platforms give for the processing of their personal data for behavioural advertising purposes.

Furthermore, it recalls that obtaining consent in these contexts does not exempt the controller from complying with the principles set out in Article 5 of the GDPR, as well as with the principles of necessity, proportionality, purpose limitation, data minimisation and fairness.

In summary, we could say that the “consent or pay” model refers to the choice provided by the controller to users to either (a) consent to the processing of their personal data for behavioural advertising purposes, or (b) pay a fee and access the service without their personal data being processed for that purpose.

Alternatives to the “consent or pay” model

The EDPB considers that in many cases large online platforms will not be able to meet the requirements for valid consent if the only option they present to users is to accept the processing of their personal data for behavioural advertising or payment of a fee. Therefore, the Board believes that offering a single alternative should not be the way forward.

Instead, it proposes that the user be offered an alternative, including the following:

(i) An “equivalent” option that does not involve the payment of a fee, nor the use of so much personal data to provide users with behavioural advertising.

(ii) An “additional” option that does not involve the payment of a fee or the processing of personal data for behavioural advertising purposes.

The option indicated in point (ii) above is crucial for assessing whether the consent given is valid under the GDPR, given that offering an “additional” option free of charge and without behavioural advertising has a significant effect on assessing whether consent is valid.

The EDPB emphasises that users' personal data cannot be considered as a tradable good. Otherwise, their fundamental right to data protection would be limited by making it conditional on the payment of a fee.

Requirements for valid consent

For consent to be valid, the following requirements must be complied with:

(i) “Voluntary consent”: To prevent any damage that might override the voluntariness of consent, the fee imposed on users must not be disproportionate to the point of conditioning individuals’ freedom of choice. Damage may be patent when users who do not consent and refuse to pay a fee are excluded from the service, especially if the service is crucial for their social or professional integration.

In this regard, the EDPB points out that data controllers have the obligation to determine whether there is an unequal relationship with the user, taking into account the influence that the online platform has within the market or the dependence that users may have on its services.

In a “consent or pay” scenario, users should be free to select the purposes for which they consent rather than being “forced” to accept a consent request that combines multiple purposes in order to use the service.

(ii) “Specific” consent: it assumes that consent must be given for specific and concrete purposes.

(iii) “Informed” consent: this implies that the information process designed by data controllers should provide users with the necessary information to understand clearly and concisely the scope and consequences of their possible decisions, taking into account the complexity involved in the processing of personal data carried out in the context of behavioural advertising.

(iv) “Unambiguous” consent: it is important that controllers carefully design the way in which consent is sought from users and avoid the use of design patterns that mislead or potentially mislead them when making a decision on whether to consent to the processing of their personal data.

Withdrawal and updating of consent

The EDPB indicates that large online platforms should provide users with an easily accessible mechanism to withdraw their consent to the processing of their personal data in relation to behavioural advertising.

Furthermore, given the nature of the processing of personal data under the “consent or pay” models, the EDPB concludes that the consent given in this context should be limited to a reasonable period of time (e.g. one (1) year).

Conclusions

(i) In the context of “consent or pay” schemes, it is imperative for large digital platforms to ensure that the consent given by users is valid, i.e. voluntary, specific, informed and unambiguous. This is why it can be problematic for these platforms to demonstrate the validity of consent given by users under the GDPR when in practice users are forced to choose exclusively between consenting to the use of their personal data for behavioural advertising or paying a fee to prevent such use.

(ii) Moreover, the “consent or pay” models that have been implemented so far create uncertainty not only as to whether the conditions for valid consent are complied with, but also as to whether the fundamental principles of the GDPR, such as purpose limitation and data minimisation, are respected.

(iii) Finally, it is important to underline that personal data should not be treated as an exchange commodity and that large online platforms should prevent the fundamental right to data protection from becoming a premium service available only to users who agree to pay a fee.

MAY 2024

Florencia Arrébola
Senior associate