On 17 April 2024, the European Data Protection Board (the"EDPB") adopted its Opinion 08/2024 on valid consent in the context ofconsent or pay models implemented by large online platforms(the "Opinion"). The Opinion addressesthe circumstances and conditions under which "consent orpay" models for behavioural advertising can meet the criteriafor valid, and particularly freely given, consent.
In the context of behavioural advertising, "consent orpay" refers to business models where a controller offers datasubjects a choice between accessing an online service for free byconsenting to processing of personal data for behaviouraladvertising purposes and paying a fee if they refuse that personaldata is being processed for these purposes.
Key takeaways of the OpinionAfter recalling the definition of consent under the General DataProtection Regulation (the"GDPR")1, the EDPB concludesthat, in most cases, large online platforms fail to meet therequirements for valid consent when presenting users with theabove-mentioned binary choice.
The EDPB built on its previous guidelines onconsent2, highlighting the fact that assessing"freely given consent" involves considering factors likedetriment when consenting, power imbalances, conditionality andgranularity. The EDPB considers that in "consent or pay"models:
Potential detriment includes financialconsequences, disruption of daily life if not having access to asocial media or hindrance to career opportunities if access toprofessional platforms is denied.Power imbalances should be evaluated, notablyaccording to factors such as the platform's market dominance,the availability of alternative services, the essential nature ofthe service and the target audience, and addressed by offeringequivalent alternatives.To prevent issues of conditionality, datasubjects should not be required to consent to processing activitiesbeyond what is objectively necessary for the performance of thecontract. Otherwise, they should be offered an "equivalentalternative."Granularity of consent, which is the abilityto separate consent for different personal data processingoperations, may be compromised in complex digital ecosystems likebehavioural advertising.Consequently, the EDPB advocates for offering a third option inthe form of a free alternative without behavioural advertising.Otherwise, if the controller deems that a fee is necessary, itshould be of an appropriate amount low enough to ensure freelygiven consent. Such alternative version could employ less intrusiveforms of advertising, such as general advertising.
Building on the judgment of the CJEU inBundeskartellamt3, the EDPB clarifies thenotion of "equivalent alternative" and explored whether,in cases where the fee for the behavioural advertising-free optionis appropriate (i.e. sufficiently low), users can still be deemedto have freely consented when opting for the free versioncontaining behavioural advertising.
Equivalent alternative: the EDPB stresses thattwo online services can be deemed equivalent if they are providedby the same controller and offer the same elements and functions.However, they do not need to be identical if differences arejustified due to the controller's inability to process personaldata for behavioural advertising purposes.Appropriate fee: the EDPB recalls thatpersonal data cannot be considered as a tradeable commodity.Ultimately, it is the controllers' responsibility to assesswhether the fee for their paid version still allows data subject togive valid consent to the processing of their personal data forutilizing the free version. However, the EDPB also reminds thatsupervisory authorities are competent to review suchassessment.All other criteria for valid consent under the GDPR remainapplicable: informed and specific consent and unambiguousindication of wishes.
What's next?Large online platforms "should assess, on a case-by-casebasis, both whether a fee is appropriate at all and what amount isappropriate in the given circumstances, bearing in mind therequirements of valid consent under the GDPR as well as the need ofpreventing the fundamental right to data protection from beingtransformed into a feature that data subjects have to pay to enjoy,or a premium feature reserved for the wealthy or thewell-off".
Footnotes
1. According to article 4(11) of the GDPR, consent of thedata subject means "any freely given, specific, informedand unambiguous indication of the data subject's wishes bywhich he or she, by a statement or by a clear affirmative action,signifies agreement to the processing of personal data relating tohim or her".In the Opinion, the EDPB specifically focuseson each of these criteria, placing particular emphasis on therequirement for freely given consent.
2. See EDPB, Guidelines 05/2020 on consent.
3. Judgement of 4 July 2023, Meta Platforms Inc. vBundeskartellamt, C-252/21, EU:C:2023:537.
The content of this article is intended to provide a generalguide to the subject matter. Specialist advice should be soughtabout your specific circumstances.