The EDPB's opinion on pay-or-consent: is the focus on protecting or indulging individuals?

On 17 April 2024, the European Data Protection Board (EDPB) adopted its Opinion 8/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms (the Opinion). The EDPB’s review of the issue comes in response to requests from the Norwegian, Dutch and German (Hamburg) data protection authorities to resolve the question of under which circumstances and conditions ‘consent or pay’ models relating to behavioural advertising can be implemented by large online platforms, taking into account of the Court of Justice for the European Union (CJEU) in Case C-252/21 (the Bundeskartellamt case).

 In view of previous decisions and opinions issed by the EDPB, not least the urgent binding decision that prohibited Meta's reliance on the legitimate interests ground for processing for behavioural advertising (which ultimate led us to the question of whether consent would work here) the EDPB’s stance is rather predictable. The core points of the Opinion are that:

• in most cases it will not be possible for large online platforms to comply with requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee; and
  

• when developing the alternative to the version of the service with behavioural advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee, and if they do opt to offer a paid-for option, they should also offer a further option that involves neither payment nor behavioural advertising.

Although the Opinion delves into other areas, the main legal issue under scrutiny is whether consent in such a model can be freely given by a data subject. The fact that it falls on the side of 'probably not', allied to some of the examples it gives for ways in which a platform might rectify the issue, hints at a belief that social networks are now essential for everyday life and people are entitled to use them without any compromise on their part. This seemingly provides a basis for arguing that behavioural advertising cannot be consented to in this context.

So, what's the EDPB's beef?

Quickly, valid consent under the GDPR must be specific, informed, freely given and unambiguous. Establishing that consent is ‘freely given’ can be a particular headache, particularly where it may be argued that there's an imbalance of power in favour of the controller . In this area, the EDPB has the following concerns:

• Freedom of choice: Essentially, a user must have a genuine choice of whether to give consent. The EDPB’s guidelines on consent explain ‘As a general rule, the GDPR prescribes that if the data subject has no real choice, feels compelled to consent or will endure negative consequences if they do not consent, then consent will not be valid.’  The Opinion states that freedom of choice depends on the options that users are offered. It asserts that the offering of only a paid-for, ad-free alterative to a service whose default model involves behavioural advertising does not go far enough, and that controllers should consider providing an ‘equivalent alternative’ that does not entail the payment of a fee. It gives the example of offering an alternative service funded by contextual or general advertising as well as the paid-for option. Note that the term ‘equivalent alternative’ was used by the CJEU in Case C-252/21 in the statement that suggested a fee-based alternative could be feasible. Meta leaned on this particular point when announcing the roll-out of its ad-free subscription service, which has perhaps prompted the EDPB to clarify its somewhat narrower interpretation of the phrase 'equivalent alternative'.

• Detriment: The Opinion suggests ‘If a data subject refuses to give their consent to the data processing for behavioural advertising purposes, and there are no other free of charge alternatives allowing them to access the same service, the data subject would face a financial consequence, as they would have to pay a fee in order to be able to use the service’ or otherwise lose access to the service. The Opinion also discusses the potential problems data subjects may encounter in participating in social life if they do not have access to social media sites. In particular, it cites ‘lock-in’ and ‘network’ effects that can lead users to feel as if access and participation on the platforms are essential to them.

• Imbalance of power: A clear imbalance in power between controller and data subject may lead the data subject to feel compelled to make a decision they otherwise would not have made, and in the case of consent-or-pay mechanisms provided by large online platforms, the Opinion mentions that power imbalance is clearly linked to detriment. Elements the Opinion suggests should be considered include: (i) the position of the company in the market (citing the Bundeskartellamt judgment that a dominant position may create a clear imbalance); (ii) so-called ‘market power’ even where a dominant position doesn’t exist, as suggested by the Advocate-General in the aforementioned case; and (iii) network and lock-in effects that make it difficult for a user to find a relevant alternative service, particularly where a service has built a large user base while offering services free-of-charge to all users. The Opinion also considers the argument that data subjects are not forced to consent or pay, and could opt not to use the service at all, but claims that such types of services ‘may result in a situation where there is no real practical option for the users to refuse to use the service…[and]…consent cannot be considered freely given simply because there is another similar service provided by a different controller which does not entail consenting to the processing of personal data for additional services’.

• Conditionality: ‘utmost account’ is to be taken of whether data subjects are required to consent to 'processing activities not objectively necessary for the contract in order to gain access to the service'. On this point, the EDPB focuses on the point of the provision of an equivalent alternative. Citing the Bundeskartellamt case, it notes that the CJEU determined that, ‘where data processing operations are not strictly necessary for the performance of the contract, users must be free to refuse to consent to such processing operations without being obliged to refrain entirely from using the service'. The Opinion further notes that the judgment mentioned the need to offer an equivalent alternative not accompanied by such data processing operations, noting in brackets the wording ‘if necessary for an appropriate fee’. The EDPB points out that these points were not defined by the CJEU and subsequently offers its own clarification on the point, which states that an equivalent alternative should avoid the situation where data subjects would be faced with a situation of conditionality leading to invalid consent. More detail is provided about what it believes comprises an equivalent alternative. It states ‘if the Alternative Version differs from the Version With Advertising only to the extent necessary as a consequence of the controller not being able to process personal data for behavioural advertising purposes, it can be in principle regarded as equivalent.’ It later states ‘The EDPB wishes to recall first and foremost that personal data cannot be considered a tradeable commodity’ and argues that certain circumstances should be present for a fee to be imposed, suggesting controllers would need to: (i) ensure that the fee does not hinder users to withhold consent or make them feel compelled to consent; (ii) assess whether they offer a genuine choice and are not nudging data subjects towards consenting. This is in some ways contradictory, as on the one hand the EDPB stresses that personal data is not tradeable but on the other implies that the price point for the paid-for service has relevance, in which case a 'fair price' may be possible.

Any problems arising out of the EDPB's approach?

While readers are left in no doubt of the EDPB's sentiments, a number of issues are left to be assessed by controllers 'on a case-by-case basis', but remain subject to broadbrush commentary. There are also areas discussed in the Opinion that would benefit from further interrogation. In particular, the following questions remain:

1. What exactly is an equivalent alternative?

The EDPB evidently does not like the idea that a platform user that does not consent to behavioural advertising would need to pay for access to the service, and suggests that a further (it may say real)  ‘equivalent alternative’ should be offered. The Opinion puts forward contextual advertising or general advertising to serve this purpose.

Appreciating that the GDPR is there to protect individuals and the EDPB will thus naturally take a view from the perspective of the data subject, the suggestion that a large online platform would offer a service funded by general advertising as an alternative to a fee-based or behavioural ad-funded services is somewhat naïve. While these may be equivalent alternatives for a data subject, they would certainly not be viewed this way by controllers. Social networks have been able to generate huge revenues because of the value marketeers see in the ability to target those who may genuinely have an interest in their products or services - not to mention that many users would rather see personalised ads than be bombarded with ads for products and services that have no relevance for them. It is one of the reasons for the decrease in TV and print advertising over recent years, certainly in the United Kingdom, and it is difficult to perceive a large online platform giving users a viable alternative model that would significantly depress their ability to make money.

The logical response to this is perhaps to suggest contextual advertising as a more effective alternative to general advertising and one that potentially could be more palatable than behavioural advertising to a lot of users. For many online resources, for example national newspapers, contextual advertising may well be the future of advertising, particularly as talk grows of a ‘cookieless internet’. Social networks such as Facebook, however, likely will encounter a conceptual issue with this. Social network algorithms do the heavy lifting in determining the content presented to users. One of the ways in which they do this is by collecting information about user interactions with the platform – factors like what content they like, what content they share, how long they spend viewing content. Content is thus served up on the basis of the user’s online behaviour.

While it may provide a less intrusive model than the current system of targeted advertising, applying contextual advertising methods to a social network still indirectly relies on an analysis of users’ behaviour onsite. Would the EDPB and national data protection authorities be comfortable with this or is it only a matter of time before contextual adverts on large online platforms face a similar fate to today’s behavioural ads?

2. What makes a fee 'appropriate'?

The Opinion recommends that controllers assess on a case-by-case basis, ‘both whether a fee is appropriate at all and what amount is appropriate in the given circumstances, taking into account possible alternatives to behavioural advertising that entail the processing of less personal data as well as the data subjects’ position’. Little guidance on how this can be calculated is given, beyond the fact that it should not effectively inhibit data subjects from making a free choice. This is perhaps a question more suited to a competition authority, as companies would probably seek to find a balance between affordability and the protection of existing revenues. And the appropriate price for the average user in Germany likely will be different to the appropriate price for the average user in Bulgaria.

However, in its arguments the EDPB makes clear that personal data is not a tradeable asset. Such a dogmatic approach surely kills any argument that it is possible to find an appropriate fee - if you can't trade personal data, if you can't capitalise on it, then surely the appropriate fee is zero. In reality, I would imagine a sizeable proportion of the European population would be entirely comfortable with sharing their data in order to receive a free service, while the EDPB and certain EEA data protection authorities might see any form of payment as sufficient detriment to invalidate consent .

It is at times difficult to see this Opinion as more than a justification of prohibiting Meta's use of personal data when there is no discussion of other paid-for versions that combine ad-free service with additional benefits. For example, certain music streaming services use playlist targeting to drive relevant adverts to users of their free versions, but their ad-free subscription services offer additional benefits such as downloadable content. Arguably, this makes it even harder to establish granularity of consent. If a tech service offers a multi-tier service with different price points, can they rely on pay-or-consent models, or by virtue of not being a Meta service are they okay to rely on legitimate interests?

3. Is a dominant position really all that pivotal here?

There is little doubt that imbalances in power can affect a data subject’s choice of whether to give consent to processing. It is also likely that market dominance could in some sectors have significant impact on the power balance between controller and data subject. The Opinion’s discussion of large online platforms’ societal roles and the perils of network and lock-in effects serve to suggest that the tech sector specific to online platforms fall within this category.

In competition law, a dominant market position will always provide cause for concern because of the potential for a dominant market leader to unfairly exploit their heightened status. When it comes to the influence a dominant market player has with respect to personal data processing, however, a more nuanced approach is required, and any assessment is likely to have an element of subjectivity.

In respect of large online platforms, many would see Facebook as a dominant player. Its users number in the billions, and a core element of its service involves communication and sharing information with other users. However, it is also worth considering just how most users interact with the service. There is well-established ‘90-9-1 Rule’ for participation in social media and online communities, which dictates that 90% of users are ‘lurkers’ who never contribute, 9% of users contribute a little, and 1% of users account for almost all the action. While the figures are a little convenient, research over the years has suggested that more people browse than actively contribute.  What this hints at is that a diminishing number of users actually rely on these platforms for their participation in society, as argued in the Opinion. Furthermore, in doing so, lurkers and sporadic contributors will share much less personal data with the platforms they use - and many will seek to further restrict the data they share through restricted use of cookies and similar technologies. With this in mind, surely there is a case that users who don't want to pay and do not want their data used for behavioural advertising actually dohave a valid third option of not using the platform.

Would it not be easier to just ban behavioural advertising?

In recent months, the EDPB has issued decisions and opinions relating to behavioural advertising on large online platforms such as Facebook. There is now an established cycle of the EDPB concluding that it is not possible for a current ad practice to comply with GDPR and the platforms reacting. This perpetual argument and counter-argument eats up time and financial resource, and for the wider sector creates little more than uncertainty.

This latest Opinion at times makes a reader wonder whether the outcome was decided before the supporting arguments, and as discussed in this post, there is no hard conclusion that demonstrates beyond reproach why the consent model cannot work. It is also worth bearing in mind the additional responsibilities imposed on large online platforms in the Digital Markets Act and, more broadly, digital service providers in the Digital Services Act, should work to reign in more exploitative forms of processing, including for advertising advertising, in any event so that adherence to the GDPR principles is easier and less likely to undermine user consent.

If behavioural advertising remains problematic for EU institutions, surely the fairer and more logical course of action would be to outlaw the practice, either in its entirety or after a certain, defined threshold of intrusiveness. Then at least those large online platforms can take a longer term view on how to generate revenues appropriately, or even whether they wish to continue providing a service in the region.