But can consent be freely given if the alternative involves a payment? Announcing a request for an opinion from the European Data Protection Board, the Norwegian data protection authority stated this issue represents "a huge fork in the road. Is data protection a fundamental right for everyone, or is it a luxury reserved for the wealthy?"
Currently, there is no unified approach in the European Union on this issue. Therefore, the request for an opinion from the European Data Protection Board on consent or pay mechanisms will affect a wide range of businesses currently (or considering) charging non-consenting users.
Meta as a case study
Perhaps with a sense of déjà vu from 2023, Meta finds itself moving into a new year under the regulatory microscope and facing ongoing legal disputes.
An appeal1 to annul the EDPB's binding decision resulting in Meta being handed the largest ever GDPR fine of €1.2 billion and other sanctions is ongoing. The company has also recently appealed2 the November 2023 instruction from the European Data Protection Board to the Irish Data Protection Commission to permanently ban the company from processing personal data for behavioural advertising on the legal bases of contract and legitimate interest in the EEA.
The EDPB-issued ban was perhaps not unexpected by Meta, as the company had already stated a prior intent to move to a legal basis of consent for processing personal data for behavioural advertising. In October 2023, the company announced that access to Facebook and Instagram via an ad-free tier would be offered to EU, EEA and Swiss users. However, any respite Meta had hoped to gain from changing their legal basis to that of consent has not occurred.
Meta's recent adversary, the Norwegian Data Protection Authority (Datatilsynet) expressed concern last year as to whether the change in legal basis was compliant with the GDPR. On 26 January 2024, Datatilsynet announced it, along with other authorities in the Netherlands and the German state of Hamburg, had requested an opinion from the EDPB on the legality of the 'pay or ok' approach under Article 64(2) GDPR.
Although the Datatilsynet request does not specifically name Meta, complaints submitted by the consumer group, noyb, to the Austrian data protection authority highlight the crux of the uncertainties facing the EDPB:
- The GDPR requires that any consent to the use of personal data must be freely given. Facebook or Instagram users are presented with the choice of consenting to the use of their data or to pay the subscription fee. Access to Facebook and Instagram on the ad-free tier can cost users up to €12.99 per month, with further linked accounts costing additional sums. The noyb complaint notes that should other companies follow suit, users choosing not to consent could face a number of payments to obtain (and maintain) access to a wide range of popular services.3
- Withdrawal of consent under the GDPR must be "as easy as giving consent." Facebook and Instagram users in the EEA now wishing to withdraw their consent are presented with the options of paying the subscription fees or continuing to use the services with trackers. Failure to choose either option effectively would leave users unable to access the service.4
What next?
The EDPB is expected to issue an opinion within 8 weeks of receipt of the request. However, an extension can be of up to 6 weeks is permitted. Given the importance of this opinion to a variety of companies and their current and future business models, the opinion will be awaited with great interest.
We will continue to provide updates on this important development.
[1] T-325/23 – Meta Platforms Ireland v European Data Protection Board
[2] T-8/24 - Meta Platforms Ireland v European Data Protection Board
[3] https://noyb.eu/en/noyb-files-gdpr-complaint-against-meta-over-pay-or-okay
[4] https://noyb.eu/en/meta-ignores-users-right-easily-withdraw-consent
