Background

The Dutch data protection authority (AP), the Norwegian data protection authority (Datatilsynet), and the Hamburg data protection authority (HmbBfDI) (the requesting authorities) sent a request to the EDPB to issue an opinion on 'consent or pay' models. This request concerned whether 'consent or pay' models can be used by large online platforms that attract large amounts of users in the European Economic Area (EEA) when data is processed for behavioral advertising purposes, in a way that satisfies the requirements for a valid, and in particular, freely given, consent. The requesting authorities also asked that the EDPB address the questions by taking into account the Court of Justice of the European Union (CJEU) judgment in Case C-252/21 Meta Platforms Inc., Meta Platforms Ireland Ltd., Facebook Deutschland GmbH v Bundeskartellamt (Bundeskartellamt Judgment).

The requesting authorities observed that several EDPB Members have already provided guidance regarding 'consent or pay' models at the national level but that it was usually aimed at smaller data controllers.

Definitions

Definition of 'consent or pay' model

In the 'consent or pay' model, as defined by the EDPB, data subjects are required to choose between at least two options to gain access to the controller's online service and are denied access in the absence of said choice.

1. Consent. The data subject can consent to the processing of their personal data for behavioral advertising purposes, which includes tracking and targeting.
2. Pay. Alternatively, the data subject can choose to pay a fee (subscription or one-off payment) and gain access to the online service without their personal data being processed for advertising purposes. The EDPB notes that other tracking technologies, such as cookies, may still be used in this scenario for purposes other than behavior advertising and if they find a lawful legal basis under the General Data Protection Regulation (GDPR).

Definition of 'behavioral advertising'

To define 'behavioral advertising,' the EDPB referred to the definition provided by Article 29 Working Party (WP29) in WP 171, page 4: 'advertising that is based on the observation of the behaviour of individuals over time' and that behavioral advertising 'seeks to study the characteristics of this behaviour through their actions (repeated site visits, interactions, keywords, online content production, etc.) in order to develop a specific profile and thus provide data subjects with advertisements tailored to match their inferred interests.'

Definition of 'large online platforms' in the context of the opinion

Regarding the definition of 'online platform' and 'large online platform,' the EDPB referred to the definitions under Article 3(i) of the Digital Services Act (DSA) for the former, and considered the following elements determining whether a controller is to be considered a 'large online platform:'

• a large amount of users;
• its position on the market; and
• the conduct of 'large scale' processing, as defined in the WP29, in WP 243, and WP 248, including, for example, the number of data subjects concerned, the volume of data, and the geographical extent of the processing activity.

Scope of the opinion and relevant legislation

The EDPB highlighted that the opinion is aimed at large online platforms, but may also prove useful more generally for applying the concept of consent in the context of 'consent or pay' models.

The EDPB also recalled the Bundeskartellamt Judgment, where the CJEU clarified that a dominant position is an important factor in determining whether consent was freely given.

Principles and general observations

The EDPB reiterated that obtaining consent does not absolve controllers from adhering to Article 5 of the GDPR and that even if processing is consent-based, it does not justify the collection of personal data beyond what is necessary for the specified purpose or in a manner that is unfair to the data subjects.

The EDPB noted the intrusive nature of behavioral advertising, as such practice may entail gathering and compiling as much personal data as possible about individuals and their activities. Accordingly, such practices should be taken into account by controllers when assessing compliance with the data minimization principle as excessive tracking is harder to reconcile with data minimization in comparison to a system of personalized advertising where users actively and consciously determine their own preferences.

The EDPB also emphasized the need for processing to:

• correspond with the data subjects' reasonable expectations;
• not unfairly discriminate against data subjects;
• avoid and account for power imbalances;
• avoid any deceptive or manipulative language or design; and
• take into account the processing's wider impact on the rights and dignity of individuals.

Controllers are further expected to respect the principles of transparency, Data Protection by Design, Data Protection by Default, and accountability.

Requirements for valid consent

Freely given

Firstly, the EDPB emphasized that when using consent as a legal basis, it is the data subject's freedom of choice that determines the legality of the processing. The EDPB explained that 'free' implies real choice, and that there is no risk of deception, intimidation, coercion, or significant negative consequences if the data subject does not consent. Alternatively, consent will not be considered free in the presence of those elements.

With reference to the Bundeskartellamt judgment, the EDPB noted that the above elements must be met on a case-by-case basis, and if there are interrelated elements, they must all be met at the time of consent.

The provision of a free alternative without behavioral advertising

The EDPB specifically stipulated that the offering of (only) a paid alternative to the service which includes processing for behavioral advertising purposes should not be the default way forward for controllers. Instead, controllers are recommended to consider providing data subjects with an 'equivalent alternative' that does not entail the payment of a fee. Further, controllers are recommended to consider offering an alternative free of charge. The alternative must not entail processing for behavioral advertising purposes but may process personal data for other purposes, provided the processing complies with the GDPR and ePrivacy Directive. This free alternative 'makes it easier for controllers to demonstrate that consent is freely given,' and is a 'particularly important factor to consider when assessing whether data subjects can exercise a real choice and therefore whether consent is valid.'

According to the EDPB, controllers should always consider the principle of fairness when evaluating 'consent or pay' models, and this should be reflected in the interface's design.

Detriment

The EDPB provided that 'freely given' consent requires data subjects to have a genuine choice and to be able to refuse or withdraw their consent without detriment, which means without experiencing harm or damage. Data subjects must have the right to withdraw their consent at any time and it should be as easy to withdraw consent as to give consent.

To avoid such detriment, and to ensure that data subjects can make a genuine choice, how the service is offered, as well as the fee (if any), should not effectively inhibit data subjects from making a free choice, for example by nudging the data subject towards consenting. Therefore, the fee in question should not be inappropriately high.

Where data subjects refuse to provide consent and are not offered a free alternative, they may face the following negative consequences:

• payment of a fee to use the service would lead to financial consequences;
• impossibility to use a service that is part of their daily lives and has a prominent role;
• loss of social interactions on social media;
• denial of access to professional or employment-oriented platforms; and
• regarding large online platforms that have only implemented the 'consent or pay' model at a later stage:
  • 'network effect' - it may be harder or unrealistic for the data subjects to not interact on the platform or choose another service; and
  • 'lock-in effect' - users may suffer irreparable loss owing to an established online presence.

The EDPB highlighted that the existence of a free alternative without behavioral advertising could be a way for the controller to remove, reduce, or mitigate such detriments.

Imbalance of power between data subjects and data controllers

The EDPB noted that in case of clear imbalance, consent cannot be used as a legal basis, save for exceptional circumstances where the controller can prove that there are no 'adverse consequences at all' for the data subject for not providing consent, notably if there is a free alternative without behavioral advertising.

The EDPB enumerated several factors that can be taken into account, on a case-by-case basis, by a controller to assess whether there is a situation of clear imbalance of power.

• Position of the company in the market, such as a dominant position. A dominant position may be determined by defining the relevant market and identifying the market share. The EDPB clarified that in the context of large online platforms implementing 'consent or pay' models, the criterion of 'imbalance of power' and 'detriment' for the assessment of whether consent is freely given are strongly connected. In particular, a clear imbalance of power against users may be seen where services have built a large user base while offering free services and building users' reliance on such services, subsequently switching to a 'consent or pay' model.
• Reliance on the service provided. The EDPB stated that a genuinely free choice is limited if the service is considered essential, e.g., to search for jobs, to get access to essential information for the data subjects' daily life, or to participate in the public debate.
• Target or predominant audience. The EDPB provides an example of an imbalance in cases where a platform is directed or predominantly used by children or other vulnerable persons.

The EDPB reiterated that consent cannot be considered 'freely given' simply because there is another similar service provided by a different controller, as well as in cases where there is no real practical option for the users to refuse the service.

Conditionality

The EDPB highlighted that where data processing operations are not strictly necessary for the performance of the contract, users must be free to refuse to consent to such processing operations without being obliged to refrain entirely from using the service, as well as, the presence of an obligation to offer 'an equivalent alternative not accompanied by such data processing operations.'

Offering an 'equivalent alternative' is interpreted by the EDPB as avoiding situations of conditionality that could lead to invalid consent.

Equivalent alternatives

The EDPB outlined different scenarios between a version of a service provided under the condition of consent to the processing of personal data for behavioral advertising purposes and an alternative version that does not require such consent.

The EDPB considered that if the only difference between both versions is the processing for behavioral advertising purposes, they should be considered equivalent. Similarly, when both versions are not identical but contain the same elements and functions without being different or having degraded quality, the versions are equivalent.

The alternate version must not be accompanied by processing that is not necessary for the provision of the service, in this case, processing for behavioral advertising purposes. For the EDPB, the alternative version should also omit processing operations that would be carried out as a precondition of processing for behavioral advertising purposes such as initial tracking.

Appropriate fees

The EDPB concluded, after consulting the Bundeskartellamt judgment that controllers should assess, on a case-by-case basis, both whether a fee is appropriate at all and what amount is appropriate in the given circumstances. Bearing in mind the requirements of valid consent under the GDPR and the need to prevent the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy.

Controllers are recommended to respect data subjects' autonomy and, in particular:

• ensure that the fee does not hinder data subjects withholding consent, nor make them feel compelled to consent;
• assess whether they offer a genuine choice for data subjects and are not nudging data subjects towards consenting; and
• determine the appropriate fee.

To demonstrate the above, the EDPB requires the controllers to document their choices and assessment of whether a given fee is appropriate in the specific case.

Granularity

The EDPB also calls attention to granularity, stipulating that when presented with a 'consent or pay' model, data subjects should be free to choose the individual purposes they accept, rather than having to consent to a bundle of processing purposes.

Informed consent

The EDPB highlighted that providing information to data subjects prior to obtaining their consent is essential to enable them to make informed decisions.

Specifically, large online platforms should consider the:

• recipients or categories of recipients of the personal data;
• fact the controller intends to transfer personal data to a third country and the period for which the personal data will be stored;
• collection and processing of data maintained by the controller irrespective of the data subject choosing to consent to the behavioral advertising;
• right of the data subject to withdraw their consent at any time and its consequences; and
• combination or cross-use of data and data collected by other controllers.

Regarding how information should be provided, the EDPB reiterated that large online platforms should provide the information prior to processing.

Specific consent

Regarding specific consent, the EDPB reminds that consent must be given for specific purposes and elaborating that specificity is closely linked to informed and granular consent. Large online platforms are recommended to define a specific, explicit, and legitimate purpose for processing activities for which consent is collected, and provide sufficient information to data subjects on such processing activities. The EDPB also states that function creep should be avoided.

Unambiguous indication of wishes

The EDPB reiterated that under Article 4(11) of the GDPR, consent must be an unambiguous indication of the data subject's wishes in the form of a statement or by clear affirmative action signifying agreement to the processing of personal data.

Withdrawing and refreshing consent

In the context of 'consent or pay,' the EDPB clarified that a distinction should be made between the exercise of the right of withdrawal and the user's wish to continue the use of the service after their withdrawal of consent to avoid giving the impression that withdrawal would automatically lead to entering into a paid subscription. Exercising the right of withdrawal should result in the user being faced with the choice of whether to give consent to the processing for behavioral advertising purposes or take out a paid subscription, or opt for the free alternative without behavioral advertising, if offered.

Conclusion

The EDPB concluded that consent collected by large online platforms when using 'consent or pay' in order to process data for behavioral advertising purposes may only be considered as valid to the extent that all the requirements for consent are met and that such platforms can demonstrate this.

Lara Eguia Privacy Analyst
[email protected]
Anastasia Konova Privacy Analyst
[email protected]