Introduction
On April 17th, the European Data Protection Board (EDPB) issued the long-awaited Opinion 8/2024, request by the Dutch, Norwegian, and German (Hamburg) authorities, regarding the admissibility of the "pay or consent" model - implemented by large platforms - as well as the validity of user’s consent to the processing of their personal data for the purposes of behavioral advertising.
What does the "pay or consent" model mean?
The "pay or consent" model allows a user, who wishes to access an online content or a service, to choose between two options: (1) pay a fee to access the online service without their personal data being processed for behavioral advertising purposes; or (2) access the service "for free" by consenting to the processing of their personal data for behavioral advertising. In the latter case, the online platform tracks the user's behavior, using cookies or similar technologies, in order to show personalized advertisements according to the user's preferences and interests.
Why has the EDPB ruled on the admissibility of such model?
In recent years, the EU Court of Justice (Case C-252/21) and several EDPB Members have already expressed their view on the matter, by providing criteria and guidance to be met in order to comply with the legislation. The requesting authorities, despite the fact that they considered the guidelines expressed to be valid, claimed that a common approach to the "pay or consent" model used by large online platforms, particularly Meta, was necessary, and therefore requested the EDPB to issue an opinion on the matter.
The EDPB's Opinion
The EDPB first reminded that the processing of personal data must comply with the principles set out in Article 5 of the GDPR, particularly the principles of necessity and proportionality, as well as the principles of purpose limitation and data minimization. In addition to these principles, the legal basis of the consent can be considered validly given if it is free, specific, and informed. Indeed, consent is considered freely given if the data subject has the freedom to choose, as well as to refuse or withdraw consent without being impacted by any disadvantage. Consequently, consent given by a user confronted with a double choice between the processing of its personal data for targeted advertising purposes and the payment of a fee, cannot be considered freely given. Moreover, consent cannot be considered freely given if there is a clear imbalance of power between the data subject and the organization. Indeed, the "pay or consent" model is used by large platforms that are in a position of greater power, able to force the users to take a decision they would not otherwise have taken, to avoid financial repercussions.
On the other hand, regarding the payment alternative, although big online platforms are not obligated to offer free services, it should be kept in mind that the right to data protection is a fundamental right recognized by the Charter of Fundamental Rights of the European Union, which should not be transformed into a right accessible upon fee payment. Therefore, platforms must assess on a case-by-case basis whether it is appropriate to charge a fee and what the appropriate amount should be, considering alternatives to behavioral advertising, based on the GDPR requirements and valid consent criteria.
Since the "pay or consent" model could be detrimental to the user who, not choosing either of the two alternative options offered, may be excluded from the service - especially if it is essential for participating in social life or professional network - the EDPB encourages online platforms to offer users a third valid alternative. This "equivalent alternative" should be free and should not involve the processing of data for behavioral advertising purposes. To this end, the EDPB provides examples of services involving the processing of a less (or no) personal data for advertising purposes, such as general advertising or advertising based on topics of interest selected by the user. Offering an equivalent alternative by the platform would be a relevant element in evaluating the criteria of validity of the consent, as it would affect users' freedom of choice.
Conclusions
In conclusion, the EDPB believes that, in most cases, large online platforms will not be able to meet the requirements for valid consent if they present users with a binary choice between consenting to the processing of their personal data for behavioral purposes and paying a fee. The EDPB reminds that data cannot be considered a tradeable commodity, and therefore, an additional alternative should be offered that does not involve paying a fee or processing data for behavioral advertising. Finally, it emphasizes that obtaining valid consent does not exempt platforms from complying with all the principles set out in Article 5 of the GDPR.
Author: Beatrice Olivo
Contact: Avv. Eduardo Guarente e.guarente@bergsmore.com
留言