EDPB issues opinion on ‘consent or pay’ models implemented by large online platforms

Scope of the Opinion 

The Opinion is limited to the assessment of the validity of consent when used as a legal basis to process personal data for behavioural advertising purposes in the context of 'consent or pay' models deployed by large online platforms. Despite this, the EDPB notes that some of the considerations expressed in the Opinion may prove useful more generally regarding consent in the context of ‘consent or pay’ models.  More generally, the Opinion reflects and builds on other opinions issued by the EDPB in connection with relying on consent as the legal basis for processing. As a result, while the Opinion is of greatest relevance to those who deploy a consent or pay model, it is also of some relevance to a much broader audience. 

Requirements and criteria for valid consent

The Opinion highlights the need to comply with all of the requirements of the GDPR, in particular those for valid consent, namely that consent is: freely given, specific, informed, and unambiguous. The Opinion notes that the criterion of ‘freely given consent’ is central to the understanding of consent as a legal basis for processing of personal data. According to the EDPB: “consent can only be valid if the data subject is able to exercise a real choice, and there is no risk of deception, intimidation, coercion or significant negative consequences if the data subject does not consent. Consent will not be free in cases where there is any element of compulsion, pressure or inability to exercise free will.”

The Opinion notes that the GDPR refers to several criteria to be taken into account when assessing whether consent is freely given, including detriment, imbalance of power, conditionality, and granularity.  It places great emphasis on the recent Bundeskartellamt judgment of the Court of Justice of the European Union. In that case, the CJEU held that:

• “the fact that the operator of an online social network, as controller, holds a dominant position on the social network market does not, as such, prevent the users of that social network from validly giving their consent”
• where a controller holds such a dominant position, this “must be taken into consideration in assessing whether the user of that network has validly and, in particular, freely given consent, since that circumstance is liable to affect the freedom of choice of that user, who might be unable to refuse or withdraw consent without detriment”
• “users must be free to refuse individually, in the context of the contractual process, to give their consent to particular data processing operations not necessary for the performance of the contract, without being obliged to refrain entirely from using the service offered by the online social network operator, which means that those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations.”

In the Opinion, the EDPB has expanded on the concept of ‘an equivalent alternative’ being required and stated that users of large online platforms should not be presented with a binary choice between ‘consenting’ to behavioural advertising or paying for a version of the service without it, but instead should also be offered an ‘equivalent alternative’ to the free version but without behavioural advertising. While the EDPB has not purported to specify that large online platforms must offer such an option, it has stated that this should be considered and that adopting such an option would make it easier to demonstrate that ‘consent’ is freely given. 

The Opinion concludes that, in most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee. The EDPB recalls that personal data cannot be considered as a tradeable commodity, and that large online platforms should bear in mind the need to prevent the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy. On the basis of the request for an opinion from the Dutch, Norwegian and German data protection supervisory authorities, the EDPB concludes in the Opinion that consent collected by large online platforms in the context of ‘pay-or-consent’ models relating to behavioural advertising may only be considered as valid to the extent that such platforms can demonstrate, in line with the principle of accountability, that all the requirements for valid consent are met, and that obtaining consent does not absolve large online platforms from complying with the other rules and principles provided by the GDPR.

The Opinion is the latest development in an ongoing battle between online platforms, data protection authorities and activists regarding the appropriate legal basis for processing personal data for behavioural advertising purposes. This is unlikely to represent the final word on the subject and further enforcement activity and litigation to stress test the approach advocated by the EDPB seems inevitable. In the meantime, organisations who rely on consent as their legal basis for processing, whether for behavioural advertising or for other purpose, have further guidance from the EDPB to ponder when considering the validity of such consent.