EDPB’S opinion on consent or pay models: Key takeaways

What happened?

On 17 April 2024, the European Data Protection Board (the “EDPB”) adopted its Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms (the “Opinion”). The Opinion addresses the circumstances and conditions under which “consent or pay” models for behavioural advertising can meet the criteria for valid, and particularly freely given, consent.

In the context of behavioural advertising, “consent or pay” refers to business models where a controller offers data subjects a choice between accessing an online service for free by consenting to processing of personal data for behavioural advertising purposes and paying a fee if they refuse that personal data is being processed for these purposes.

Key takeaways of the Opinion

After recalling the definition of consent under the General Data Protection Regulation (the “GDPR”)¹, the EDPB concludes that, in most cases, large online platforms fail to meet the requirements for valid consent when presenting users with the above-mentioned binary choice.

The EDPB built on its previous guidelines on consent², highlighting the fact that assessing “freely given consent” involves considering factors like detriment when consenting, power imbalances, conditionality and granularity. The EDPB considers that in “consent or pay” models:

• Potential detriment includes financial consequences, disruption of daily life if not having access to a social media or hindrance to career opportunities if access to professional platforms is denied.
• Power imbalances should be evaluated, notably according to factors such as the platform's market dominance, the availability of alternative services, the essential nature of the service and the target audience, and addressed by offering equivalent alternatives.
• To prevent issues of conditionality, data subjects should not be required to consent to processing activities beyond what is objectively necessary for the performance of the contract. Otherwise, they should be offered an “equivalent alternative.”
• Granularity of consent, which is the ability to separate consent for different personal data processing operations, may be compromised in complex digital ecosystems like behavioural advertising.

Consequently, the EDPB advocates for offering a third option in the form of a free alternative without behavioural advertising. Otherwise, if the controller deems that a fee is necessary, it should be of an appropriate amount low enough to ensure freely given consent. Such alternative version could employ less intrusive forms of advertising, such as general advertising.

Building on the judgment of the CJEU in Bundeskartellamt³, the EDPB clarifies the notion of “equivalent alternative” and explored whether, in cases where the fee for the behavioural advertising-free option is appropriate (i.e. sufficiently low), users can still be deemed to have freely consented when opting for the free version containing behavioural advertising.

• Equivalent alternative: the EDPB stresses that two online services can be deemed equivalent if they are provided by the same controller and offer the same elements and functions. However, they do not need to be identical if differences are justified due to the controller's inability to process personal data for behavioural advertising purposes.
• Appropriate fee: the EDPB recalls that personal data cannot be considered as a tradeable commodity. Ultimately, it is the controllers’ responsibility to assess whether the fee for their paid version still allows data subject to give valid consent to the processing of their personal data for utilizing the free version. However, the EDPB also reminds that supervisory authorities are competent to review such assessment.

All other criteria for valid consent under the GDPR remain applicable: informed and specific consent and unambiguous indication of wishes.

What’s next?

Large online platforms “should assess, on a case-by-case basis, both whether a fee is appropriate at all and what amount is appropriate in the given circumstances, bearing in mind the requirements of valid consent under the GDPR as well as the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy, or a premium feature reserved for the wealthy or the well-off”.

This may result in large online platform using equivalent alternatives without requesting consent.