The European Data Protection Board (EDPB) recently published an opinion on the validity of “consent or pay” models implemented by large online platforms. This comes after the Dutch, Norwegian, and German supervisory authorities asked for clarification regarding the validity of Meta’s highly controversial “pay or okay” model under EU privacy laws.
Since November 2023, Meta has been forcing its users to make a “Faustian” choice: consenting to intrusive data processing for advertising purposes or agreeing to pay an expensive monthly fee. This latest move of Zuckerberg’s company has sparked significant backlash from many privacy advocates across the EU.
In its binding opinion, the EDPB establishes that large online platforms wishing to implement a “consent or pay” model may only do so if they offer a choice to their users. Specifically, platforms need to meet all criteria for valid consent expressed in GDPR and give due consideration to “conditionality, detriment, imbalance of power and granularity”.
This is not a welcome development for Meta as its platforms are—yet again—in open breach of EU law. Meta’s business model, which relies on extensive data tracking, does not conform to the obligation of “freely given, specific, informed and unambiguous” consent as required by Art. 4(11) GDPR.
Hence, Meta will have to rethink its data collection practices. According to the Board, the company will have to consider offering a third, equivalent, consent alternative to the “pay or okay” that does not involve paying a fee to escape their tracking of data and behavioural advertising.
At the same time, it is noteworthy that the opinion was not met with enthusiasm from privacy advocates. Instead, some pointed out contradictions within the opinion and that the EDPB did not unequivocally ban all “consent or pay” models. Eventually, this might have the opposite of the intended effects, namely the normalisation of the “consent or pay” model. This development would be particularly dangerous as it signals that privacy in Europe has become a “paid service”.
Overall, the EDPB’s opinion is only a half-win for privacy advocates. The fight for data privacy and against Big Tech’s lucrative, invasive tracking is set to continue across many dimensions of EU law, from privacy and consumer rights to competition policy.
Giulia Torchio is a Junior Policy Analyst in the Europe’s Political Economy Programme at the European Policy Centre.
The support the European Policy Centre receives for its ongoing operations, or specifically for its publications, does not constitute an endorsement of their contents, which reflect the views of the authors only. Supporters and partners cannot be held responsible for any use that may be made of the information contained therein.