May 7, 2024

No Consent No Pay: Framing the debate about Consent or Pay

Thomas Ghys
LinkedIn

'Consent or pay' is one of the most debated and divisive topics since the demise of the Privacy Shield. In its simplest form, a consent or pay model offers a trade-off between free access with consent for behavioural advertising or a fee for access without behavioural advertising¹. Privacy activists consider Consent or Pay an attack on freely given consent. Online service providers want to preserve their right to run an ad-funded business model.

The stakes are high and one-sided outcomes are highly undesirable. Indeed, users can't be coerced to sell their data or pay a monopoly tax. However, severe restrictions of advertising business models may push service providers towards pure subscription models that significantly limit access to editorial and user-generated content.

The rationale behind Consent or Pay

Ad-funded services such as online media, social media, content creators fully or partly rely on advertising revenues to fund their services. Ads can be selected based on the context of the page ('contextual'), the usage of an online service ('behavioural²'), characteristics of a user ('socio-demographic') or interactions with a brand ('retargeting').

Consent is a prerequisite for all advertising campaigns. Without consent, online services can only serve an advertisement based on an IP-address without any targeting, measurement or frequency capping, and, hence, without any market appetite. It is a common misconception that contextual ads can be served without consent. Serving an ad within the context of a page indeed does not involve personal data or access to information on a device other than an IP address³. However, any advertising campaign requires attribution for commercial viability (i.e., advertisers only pay what they measure). Therefore, contextual campaigns generally require consent for ad performance measurement and frequency capping⁴.

Monetizing "reject all" users

In recent years data protection authorities, most notably CNIL, have cracked down on the requirement of a "reject all" choice on the first screen of cookie consent banners. These balanced banners lower the acceptance rate by around 20 percentage points⁵ with a potentially larger impact on addressable page views for advertising. Austrian publisher Der Standard introduced the notion of a fee for access when users refuse advertising. Many European publishers - mainly in Germany, Austria, France, Italy and Spain -- followed suit. Consent or Pay stole the limelight when Meta rolled it out for Facebook and Instagram in Europe. Now it's on.

Freely given consent and pay?

Consent or Pay raises fundamental questions about the notion of freely given consent under the GDPR and related requirements. Here' a quick recap of the starting point.

The right to a private life and the protection of personal data are a fundamental in the EU⁶. So is the right to conduct a business⁷.

Consent is freely given, freely informed and unambiguous indication of wishes⁸.

Consent is not freely given if:

the user doesn't have a genuine or free choice⁹;
can't refuse without detriment¹⁰;
the controller is in a clear position of power over the user¹¹;
users can't express separate choices for different processing activities¹²;
access to a service is conditional on consent for processing activities that are not objectively necessary for a contract¹³

Supporters and detractors interpret these requirements very differently. We have summarized the main arguments of both sides in the table below (see further reading for interesting opinions). The battle will likely continue in local courts when the recent EDPB opinion triggers new complaints against social media providers or publishers.

Arguments for and against Consent or Pay

👎 Nay	👍 Yey
Consent or pay commoditizes a fundamental right for privacy. In other words, users are selling their privacy.	The fundamental right to data protection can’t negate the freedom to conduct a business. Controllers still need to comply with ePrivacy and GDPR when users prefer behavioural advertising over a fee for access.
A fee for consent refusal easily tips the balance towards acceptance.	There is no such thing as a free online service. A reasonable fee for an equivalent service does not necessarily lead to “detriment”.
If a clear imbalance exists, the controller needs to prove that there are no adverse consequences at all. Substantial extra costs cause an imbalance between the individual and the controller.	The dominant position of a controller does not preclude valid consent.
Only purposes that directly support monetization (i.e., advertising) can be included in the consent-or-pay trade-off.	Analytical, content, and social media purposes also contribute to the remuneration of a service. Consent for different purposes is not mandatory in every case.

In short, consent or pay remains legally uncertain and always requires a case-by-case assessment. In a series of posts, we will comb through the current guidelines and case law to find generally applicable data protection requirements for Consent or Pay.

Footnotes

Many variants exist following tactical choices about the scope of purposes within the trade-off choice and the relation of the pay option to other subscriptions. ↩
Note that behavioural advertising is a subset of personalised advertising that can also include user profiles based on registration data (e.g., age, region) and transactions. ↩
The context of the page is scraped independently from the user visit. ↩
Except for countries where the national adoption of the ePrivacy Directive led to an expanded consent exemption such as the Netherlands. ↩
The Didomi privacy barometer shares general statistics on the impact of consent banner designs on opt-in rates. ↩
EU Charter of Fundamental Rights, art 7 and 8 ↩
EU Charter of Fundamental Rights, art 16 ↩
GDPR, art 4 ↩
GDPR recital 42 para. 5 ↩
idem ↩
GDPR recital 43 para. 1 ↩
GDPR recital 43 para. 2 ↩
GDPR, art. 7(4) ↩