There's rarely a quiet week in data protection — and this one was no exception. Below is the most interesting development from the past seven days that caught my eye.
Readers of several prominent British news websites will have noticed something different when visiting their websites over the past few weeks: the introduction of a "pay or consent" banner.
Over the past 12 months the topic of pay or consent — giving users a choice between (i) paying for ad-free services and (ii) consenting to their personal data being used for behavioural advertising — has been developing into of one the most important aspects of data protection law in Europe.
In April 2024, the European Data Protection Board issued an opinion — in the context of "large online platforms", but its conclusions will in time apply more broadly — which found that pay or consent models are, practically speaking, very difficult to operate in a way that meets the GDPR's consent requirements.
Also in April the UK ICO issued a "call for views" on pay or consent — and said that, in principle, the model does not violate data protection laws. Although the EDPB's opinion takes the same starting point, the tenor of the ICO's wider views on behavioural advertising suggests that it may endorse — or at least be willing to accept — a more liberal interpretation of the UK GDPR's consent requirements in the context of these models.
Why Now?
Do British publishers have reason to believe that the ICO will permit the use of pay-or-consent models. Are they forcing the ICO's hand? Or something else?
The loosening of data protection requirements in the UK post-Brexit was touted by the previous government as a benefit of leaving the EU. However, those "benefits" have not materialised, and — for now — the EU and UK regimes remain broadly aligned.
But if the ICO takes a less strict view of pay or consent than the EDPB, that would be an important point of difference. And while most organisations continue to operate (largely) uniform data protection compliance programmes across the EU and UK, this is an area where that would likely change.
Lastly, although pay or consent models are primarily being used by some tech platforms and online publishers (i.e., news sites), the ICO's approach applies to advertising-funded businesses more generally, which brings into scope a whole host of apps, games and so on. So the potential ramifications here are significant.
The ICO has said that it will announce its position on pay or consent later this year. I think it is more likely than not that the ICO will allow the models — perhaps with restrictions, but likely in a way that makes pay or consent more workable than under the EDPB's approach. Watch this space.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.