Consent or pay
{{short description|Data privacy compliance tactic}}
{{Use British English|date=May 2023}}
{{use dmy dates|date=May 2023}}
Consent-or-pay, also called pay-or-okay, is a compliance tactic used by certain companies, most notably Meta, to drive up the rates at which users consent to data processing under the European Union's General Data Protection Regulation (GDPR). It consists of presenting the user with a tracking consent notice, but only allowing a binary choice: either the user consents to the data processing, or they are required to pay to use the service, which is otherwise free to use if data processing is consented to. The tactic has been criticised by privacy advocates and non-governmental organisations such as NOYB and Wikimedia Europe, which claim that it is illegal under the GDPR. On 17 April 2024, the European Data Protection Board released a non-binding opinion stating that in most cases, consent-or-pay models do not constitute valid consent within the meaning of the GDPR.
Background
Under the GDPR, the processing of a natural person's personal data is only allowed under six lawful bases: consent, contractual necessity, legal obligation under EU or member state law, public interest, protection of vital interest of an individual, and the processor's legitimate interest.{{cite web |title=Process personal data lawfully {{!}} European Data Protection Board |url=https://www.edpb.europa.eu/sme-data-protection-guide/process-personal-data-lawfully_en |website=www.edpb.europa.eu |access-date=23 May 2024}}
When the GDPR first came into force in 2018, Meta justified its processing of personal data by claiming that its terms of use constitute a contract under which the user consented to the processing of personal data.{{cite web |last1=Schechner |first1=Sam |title=Meta’s Targeted Ad Model Faces Restrictions in Europe |url=https://www.wsj.com/articles/metas-targeted-ad-model-faces-restrictions-in-europe-11670335772 |website=WSJ |access-date=23 May 2024 |archive-url=https://archive.today/20231020112038/https://www.wsj.com/articles/metas-targeted-ad-model-faces-restrictions-in-europe-11670335772 |archive-date=20 October 2023 |url-status=live}}{{cite web |last1=Lomas |first1=Natasha |title=Meta's New Year kicks off with $410M+ in fresh EU privacy fines |url=https://techcrunch.com/2023/01/04/facebook-instagram-gdpr-forced-consent-final-decisions/ |website=TechCrunch |access-date=23 May 2024 |date=4 January 2023}}
However, this was challenged by Max Schrems, an Austrian privacy activist, who successfully argued that contractual necessity was not a valid basis of data processing when it comes to personalised advertising.{{cite web |last1=Horwitz |first1=Sam Schechner and Jeff |title=Meta to Let Users Opt Out of Some Targeted Ads, but Only in Europe |url=https://www.wsj.com/articles/meta-to-let-users-opt-out-of-some-targeted-ads-but-only-in-europe-44b20b6d |website=WSJ |access-date=23 May 2024 |archive-url=https://archive.today/20230331163526/https://www.wsj.com/articles/meta-to-let-users-opt-out-of-some-targeted-ads-but-only-in-europe-44b20b6d |archive-date=31 March 2023 |url-status=live}}
In response to this ruling, Meta changed its lawful basis for personal data processing from contractual necessity to legitimate interest, which was also found not to be a valid basis.{{cite web |last1=Lomas |first1=Natasha |title=Meta tries to keep denying EU users a free choice over tracking -- but change is coming |url=https://techcrunch.com/2023/03/30/meta-facebook-gdpr-ads-tracking/ |website=TechCrunch |access-date=23 May 2024 |date=30 March 2023}}{{cite web |last1=Lomas |first1=Natasha |title=Meta to offer ad-free subscription in Europe in bid to keep tracking other users |url=https://techcrunch.com/2023/10/30/meta-ad-free-sub-eu/ |website=TechCrunch |access-date=23 May 2024 |date=30 October 2023}}
Meta then changed its lawful basis to consent, but chose to implement it in a way where users who consented to personalised advertising could use the service for free, while those who did not were required to pay a monthly subscription fee to continue using the service.
Critics of this consent model have called it "pay-or-okay", claiming that the monthly fee is disproportional and that users are not able to withdraw their consent to tracking as easily as it is given, which the GDPR requires. Massimiliano Gelmi, a data protection lawyer at NOYB, has stated that "The law is clear, withdrawing consent must be as easy as giving it in the first place. It is painfully obvious that paying €251,88 per year to withdraw consent is not as easy as clicking an 'Okay' button to accept the tracking."{{cite web |last1=Lomas |first1=Natasha |title=European digital rights groups say the future of online privacy is on a knife edge |url=https://techcrunch.com/2024/02/15/no-consent-or-pay-pls/ |website=TechCrunch |access-date=23 May 2024 |date=16 February 2024}}{{cite web |last1=Lomas |first1=Natasha |title=Meta faces another EU privacy challenge over 'pay for privacy' consent choice |url=https://techcrunch.com/2024/01/10/meta-pay-or-okay-noyb-complaint-2/ |website=TechCrunch |access-date=23 May 2024 |date=11 January 2024}}
On 17 April 2024, the European Data Protection Board released a non-binding opinion stating that in most cases, consent-or-pay models do not constitute valid consent within the meaning of the GDPR.{{cite web |last1=Meyer |first1=David |title='Meta is out of options': EU privacy regulators reject fee for avoiding tracking |url=https://fortune.com/2024/04/17/meta-pay-for-privacy-rejected-edpb-eu-gdpr-schrems/ |website=Fortune |access-date=23 May 2024 |archive-url=https://archive.today/20240417165303/https://fortune.com/2024/04/17/meta-pay-for-privacy-rejected-edpb-eu-gdpr-schrems/ |archive-date=17 April 2024 |language=en |url-status=live}}
European Commission investigation and fine
On 1 July 2024, the European Commission announced that it had opened an investigation against Meta under the provisions of the Digital Markets Act (DMA), with the preliminary findings claiming that Meta's approach was not in compliance with the DMA, an assertion that Meta has disputed.{{cite web |last1=Dmitracova |first1=Olesya |title=Meta accused of breaking European law with its ‘pay or consent’ model |url=https://edition.cnn.com/2024/07/01/tech/meta-eu-competition-rules/index.html |website=CNN |access-date=11 July 2024 |language=en |date=1 July 2024}} On 22 April 2025, the Commission found that Meta's binary
that was in effect on Facebook and Instagram from November 2023 to November 2024 was not compliant with the DMA, and fined Meta €200 million. The Commission stated that it is still assessing Meta's new version of Consent or Pay
advertising modelconsent or pay,
which uses less personal data and was introduced in November 2024.{{cite web | title=Commission finds Apple and Meta in breach of the Digital Markets Act | url=https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085 | website=European Commission | access-date=23 April 2025 | language=en | date=22 April 2025}}
Other users
Although Meta has faced most of the scrutiny and criticism regarding the use of consent-or-pay, other companies have also utilised the tactic. The Austrian Data Protection Authority (Datenschutzbehörde) has found that Der Standard, a German-language newspaper, has acted unlawfully by using consent-or-pay on its site, while others, including Der Spiegel, Die Zeit, Heise, the Frankfurter Allgemeine Zeitung, the Kronen Zeitung, and T-Online, have been accused of doing the same.{{cite web |last1=Clasen |first1=Alina |title=Austria challenges EU newspapers’ pay-or-cookie walls |url=https://www.euractiv.com/section/media/news/austria-challenges-eu-newspapers-pay-or-cookie-walls/ |website=Euractiv |publisher=Euractiv |access-date=23 May 2024}}
References
{{reflist}}
{{Privacy}}
{{Portal bar|European Union|Law}}