The European Data Protection Board (“EDPB”) has adopted an Opinion addressing so-called ‘consent or pay’ models deployed by large online platforms. It concludes that in most cases it will not be possible for such models to comply with the requirements for valid consent under the GDPR.

We have previously commented here on a recent consultation by the Information Commissioner’s Office in relation to such consent or pay models. In short, they are a response to the need for large online platforms to establish a lawful basis under the GDPR for the processing of personal data for behavioural advertising purposes. As an alternative to relying on ‘legitimate interests’, platforms have turned to ‘consent’ as the lawful basis for such processing. For those who do not consent to the processing of their data for user profiling, the proposed solution is that they pay for access to ad-free services. Hence, ‘consent or pay’.

These models have attracted criticism (see our previous piece here) on the basis that they do not offer real choice to the users of these platforms, such that consent is not freely given for the purposes of the GDPR. Simply put, if the result of users not paying the fee is that they face exclusion from these services – which are ubiquitous and heavily relied upon – they are left with no alternative but to agree to the processing.

The EDPB has endorsed these concerns, stating that “in most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee”.

In order to comply with the GDPR, the EDPB has said that platforms should offer a “truly equivalent alternative” to the binary ‘pay or consent’ options. The Opinion offers guidance on how to ensure that an alternative is genuinely equivalent, confirming that it will likely be so if it is different “only to the extent necessary as a consequence of the controller not being able to process personal data for behavioural advertising purposes”. As to whether platforms should charge for such an alternative service, the EDPB suggests that controllers assess on a case-by-case basis whether a fee is even appropriate at all, and if it is, ensure that “it is not such as to inhibit data subjects from making a genuine choice in light of the requirements of valid consent and of the principles under Article 5 GDPR, in particular fairness”. Ultimately, the EDPB stresses that “personal data cannot be considered as a tradeable commodity, and controllers should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy”.

The EDPB also recommends that any alternative consent or pay model should be well-designed and have a sufficient level of granularity so that users’ consent is ‘informed’ and ‘specific’. In other words, users should know what it is that they are being asked to consent to, and can choose which purpose of processing they accept “rather than being confronted with one consent request bundling several purposes”.

The EDPB Opinion has already drawn criticism: IAB Europe has said that it has “grave reservations”, and that the Opinion is “at odds with the prevailing jurisprudence of the CJEU and highly mischaracterizes both the ‘consent or pay’ model and personalised advertising.” It criticises the EDPB’s suggestion of an alternative model that effectively, in its view, amounts to a “quasi-mandatory condition for obtaining valid consent without adducing any empirical research or other evidence to justify why companies should develop another version of their service free of charge and funded by a different form of advertising such as contextual”. As a result, IAB Europe repeats its call for a public consultation on these matters “to ensure the development of sound policy guidance that takes account of all pertinent stakeholders’ concerns and interests”.

Read the Opinion in full here and IAB Europe’s response here.