The Information Commissioners Office has issued a call for views on 'consent or pay' business models, also referred to as 'pay or ok' models.
Following the lead of European data protection authorities, this call for views will form part of the ICO's ongoing cookie compliance work. 'Pay or ok' models are summarised by the ICO as "giving people a choice between accessing online services without payment if they consent to their personal information being used for personalised advertising or, if they refuse this consent, having to pay to access that service”.
There are no specific reports that 'pay or ok' consent models will be widely introduced in the UK in the near future, but the ICO has stated there are indications that some businesses are considering these models. Therefore, it should be welcomed that the ICO is seeking to clarify their regulatory approach.
The ICO makes clear that data protection law in the UK does not prohibit business models that involve a 'pay or ok' business model. However, this is a complex and emerging issue, which the ICO expects to expand on later this year when updated guidance on cookies and similar technologies will be consulted upon.
As a starting point, the ICO has set out a range of factors that organisations will need to consider in assessing whether a 'pay or ok' would provide valid consent for personalised ads:
- Power balance – Consent for personalised ads may not be freely given where users have little or no choice whether to use a service or not, particularly where that service has a position of market dominance or is a public service.
- Equivalence – Is there a difference between the ad-free or ad-funded tiers, such as additional bundled services?
- Appropriate fee – Consent for personalised ads is unlikely to be freely given if the alternative is an unreasonably high fee. This issue has been raised by consumer organisations in Europe, who have highlighted how ad-free tiers on a number of social media networks could create large monthly/annual payments for users.
- Privacy by design? – Users must be presented with clear understandable information about the choices they face. Consent for personalised ads is unlikely to be freely given where users do not understand how they can access the service without having to agree to the use of their personal information.
Additional considerations stated by the ICO also include special consideration being given to existing users, who may rely on the service or platform extensively. Users must also be provided with clear details on what will happen with any personal information provided by them. Information on the withdrawal of consent without detriment should also be provided.
The call for views will close on 17 April 2024.
Developments in Europe
As we have highlighted in previous updates, 'pay or ok' subscription models have been gradually growing in visibility and use across the European Union in recent months.
The European Data Protection Board is expected to issue an opinion on 'pay or ok' models following requests from data protection authorities across Europe, and pressure from consumer organisations.
