On Wednesday, 17 April, the European Data Protection Board (EDPB) issued its Opinion on the legality of Meta's tiered (Consent or Pay) subscription model following a request by the Dutch, Norwegian, and Hamburg data protection authorities (DPA) under Article 64(2) of the EU General Data Protection Regulation (GDPR).
In a press release, the EDPB said that "in most cases", large online platforms will not be able to comply with valid consent requirements under GDPR if they only present users with the option to consent to the processing of personal data for behavioural advertising or pay a fee. Instead, the EDPB recommends that large online platforms should provide individuals with an ‘equivalent alternative’ that does not entail the payment of a fee.
Anu Talus, EDPB Chair, said: “Online platforms should give users a real choice when employing ‘consent or pay’ models. The models we have today usually require individuals to either give away all their data or to pay. As a result most users consent to the processing in order to use a service, and they do not understand the full implications of their choices.”
The EDPB also draws attention to the fact that obtaining consent does not absolve controllers from adhering to all the principles outlined under Article 5 of the GDPR, such as purpose limitation, data minimisation and fairness.
Separately to today's Opinion, the EDPB confirmed that it will consult with stakeholders on the issue of broader guidelines for Consent or Pay models.
In a statement, Austrian privacy campaign group NOYB welcomed the news, but cautioned the decision will need to be analysed in more detail as it only addresses pay or consent models for large platforms. Max Schrems, NOYB honorary chair, said, "Overall, Meta is out of options in the EU. It must now give users a genuine yes/no option for personalised advertising. It can still charge sites for reach, engage in contextual advertising and the like - but tracking people for ads needs a clear 'yes' from users."
Meanwhile, in an article for the IAPP, Tobias Judin, head of the international section at the Norwegian DPA, said the EDPB's Opinion offers clarity to industry professionals and that it reconciles Consent or Pay models in the context of the Court of Justice of the European Union (CJEU) ruling against Meta in Case C-252/21. However, in the same article, University of Surrey associate professor of Law Mikołaj Barczentewicz said: "The most important takeaway is that the EDPB — however grudgingly — confirmed that 'pay-or-consent' models are, in principle, compatible with the GDPR."
What is this page?
You are reading a summary article on the Privacy Newsfeed, a free resource for DPOs and other professionals with privacy or data protection responsibilities helping them stay informed of industry news all in one place. The information here is a brief snippet relating to a single piece of original content or several articles about a common topic or thread. The main contributor is listed in the top left-hand corner, just beneath the article title.
The Privacy Newsfeed monitors over 300 global publications, of which more than 4,350 summary articles have been posted to the online archive dating back to the beginning of 2020. A weekly roundup is available by email every Friday.
