Targeted advertising conducted by the tech giants has been under heated discussion the past years. Meta introduced the so-called "consent or pay" model under which an European user could decide to pay to use the platform without ads or give consent to behavioral advertising. The discussion surrounding this has continued as the European Data Protection Board (EDPB) adopted its opinion (08/2024) by request from several European Data Protection Authorities.
The question in short was whether this model can constitute a valid consent on large online platforms which attract a large number of users within the EEA and the data is used for behavioral advertising. It may have not come as a surprise that the EDPB concluded that this way of working does not "in most cases" fulfill the requirements for a valid consent under the GDPR, according to which consent must be freely given, specific, informed, and unambiguous.
Opinion of the European Data Protection Board
The EDPB considers that consent or pay models implemented by large online platforms such as Meta generally do not meet the conditions for valid consent if the user is given only two options to choose from. According to EDPB Chair Anu Talus, online platforms should give users a real choice and states that most users will consent to the terms in order to use the service without understanding the full implications of this. Even though a valid consent is obtained, the general principles of the GDPR such as necessity, proportionality and transparency should be respected.
According to the EDPB, personal data cannot be considered as a tradeable commodity and the offering of (only) a paid alternative to the service which includes processing for behavioral advertising purposes should not be the default way forward for controllers.
The EDPB states that controllers (in other words, the platforms) should consider offering an equivalent alternative which does not include payment, meaning a consent cannot be considered valid if there is no other choice that is considered to be as good. This could be for example using the same service with advertising that is not targeted.
What's next?
The discussion will continue as the nonbinding opinion of the EDPB cannot enforce nor place a judgment on the matter. We will thus have to wait for a decision from the Data Protection Authorities who referred the matter to the EDPB (The Netherlands, Norway and Hamburg in Germany) or the Irish Data Protection Commission.
It should also be noted that the opinion concerns solely "large online platforms" but the EDPB stated that it will publish further guidance later in 2024 for also smaller platforms. The definition of online platforms is then again defined the Digital Services Act but the definition used by the EDPB is not defined elsewhere.
Originally published 24 May 2024
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.