Recent developments continue to demonstrate the pressure that adtech business models face across the UK and Europe. In recent months, the Information Commissioner's Office has challenged companies to ensure that their use of advertising cookies in the UK complies with data protection law. In Europe, the French data agency recently fined Amazon €10 million in respect of its cookies policy, and draft guidelines on the ePrivacy Directive extending the legislation's application to emerging technologies are also under consideration.
More specifically, Meta's business models continue to face scrutiny. Following the introduction of subscription models for Instagram and Facebook in the EEA, the European Data Protection Board ("EDPB") is in the process of issuing an opinion on 'pay or ok' user consent mechanisms. Consumer activist groups continue to lobby the EDPB arguing that a two-tier privacy system will follow if 'pay or ok' mechanisms become widespread. The opinion of the EDPB is expected to fundamentally affect both data protection and the business models of those who rely upon advertising technology.
By comparison, the UK may currently be seen as a more favourable regulatory environment for businesses. However, a recent decision by the Competition Appeal Tribunal granting an opt-out collective proceedings order against Meta will prompt interest from companies using data collection to monetise their business models.
This article reviews recent events in this important area.
'Take it or leave it'
The Competition Appeal Tribunal has granted an opt-out collective proceedings order (CPO) to Dr Liza Lovdahl Gormsen as proposed class action representative in respect of an action alleging Meta has abused its dominant market position.
To summarise, Facebook is operated by Meta in the UK at no monetary cost to users. User data is monetised through the operation of third party advertising.
Meta combines user data collected on the Facebook platform ("On-Facebook Data") with that data extracted by Meta via other Meta services and third party websites and applications ("Off-Facebook Data"). This combined data has generated substantial revenue for Meta via targeted advertising. The action alleges that that Meta is abusing the dominance of its market position by:
- Failing to offer users a choice as to whether or not Off-Facebook Data could be used by Meta (A take-it-or-leave-it offer)
- The collection of the Off-Facebook Data involves the imposition of an unfair price within the meaning of the United Brands line of case law.
In 2023, the CAT declined Dr Gormsen permission to commence collective proceedings on the basis that the Pro-Sys test was not satisfied in that there was no clear blueprint to trial. In the words of the CAT, the Pro-Sys test " seeks to ensure that arguable cases do not go “off the rails” in terms of case management " and that cases can be resolved with " a minimum of procedural fuss and a maximum of focus on the substantive issues ". Dr Gormsen was provided with a stay to allow a root-and-branch re-evaluation of the methodology, and she submitted a revised application rather than pursuing an appeal of the initial CAT refusal to the Court of Appeal.
Reviewing the revised application, the CAT held that the Pro-Sys test was now satisfied, and once properly understood the claim would be straightforward to manage. However, the claim is still subject to 'massive substantive complexity', and thus Dr Gormsen was encouraged to summarise the Draft Claim Form in no more than ten pages for the benefit of the parties.
The parties are expected to discuss further directions with a view to the matter being tried in the first half of 2026 at the latest.
The judgment of the Competition Appeal Tribunal in Dr Liza Lovdahl Gormsen v Meta Platforms, Inc. and Others [2024] CAT 11 can be found here.
'Pay or ok'
Following the decision of EPDB to ban Meta from processing personal data for behavioural advertising on the legal bases of contract and legitimate interest in the EEA, any hopes that a subscription-based user consent mechanism would prove to be a panacea for the company have been mistaken to date.
As highlighted earlier, and in our February bulletin, data protection authorities in Norway, the Netherlands and the German state of Hamburg have requested an opinion from the EDPB on the legality of this 'pay or ok' approach under Article 64(2) GDPR.
With the opinion expected shortly, the activist group noyb, as part of a wider group of non-governmental organisations, has published correspondence lobbying the EDPB to reject 'pay or ok' models. This was soon followed by complaints lodged with national data protection authorities by eight consumer groups from the BEUC network of European consumer organisations. Their complaints argue that 'pay or ok' measures prevent users from freely giving consent to the use of personal data.
Similarly, the noyb correspondence argues that Meta, and other companies, are aware that a majority of users will be unwilling or unable to pay fees to access to their platforms. The consent rate for those platforms with 'pay or ok' is 99.9% and the letter raises concerns that accepting 'pay or ok' would create a substantial loophole in the GDPR, risking an outcome " in which privacy becomes a luxury rather than a fundamental right. "
