The EDPB opinion on 'Consent or Pay' models explained

Dutch, Norwegian, and German (Hamburg) supervisory authorities asked the European Data Protection Bureau (EDPB) to provide guidance on when and how large online platforms could implement “Consent or Pay” models for behavioral advertising while ensuring that the consent obtained is valid and freely given, in light of the CJEU's judgment in C-252/21. 

On April 17, the EDPB released its opinion, a 42-page document that I will review in this article, helping you decipher the content before introducing some of its more problematic aspects and sharing my take on the topic. 

TL;DR: The EDPB stressed that simply offering users a binary choice between consenting to data processing for advertising or paying a fee is unlikely to meet the standards for valid consent.

Breaking down the EDPB opinion 

The EDPB opinion introduces three main requirements missing from the current “Consent or Pay” model to meet the standard for valid consent. 

The need for a free alternative

At the center of its opinion, the EDPB suggests that when developing alternatives to services that include behavioral advertising, large platforms should offer an 'equivalent alternative' that does not require payment. In other words, if a fee is to be charged for an alternative service, platforms should also consider providing another free version that does not involve behavioral advertising. 

According to the EDPB, this approach is critical to avoid making consent conditional and to ensure it remains freely given without the detriment associated with excluding users from essential services.

Power imbalance as a key factor

The opinion also emphasizes the importance of factoring in a potential power imbalance between data subjects and controllers, taking into account factors such as market dominance, lock-in effects, and the essential nature of the service provided. 

This appears to introduce a new obligation for controllers not explicitly outlined in the GDPR, requiring them to conduct an "imbalance of power assessment" to determine if their relationship with users, under specific operating conditions, exhibits a power imbalance that could invalidate the "pay or ok" model.

Transparency through granularity

Lastly, the EDPB highlights the need for users to be able to choose specific processing purposes they agree to rather than bundling several purposes under a single consent request. 

This granularity, along with the specificity and clarity of information provided to users, would ensure that consent is not only informed but also an unambiguous indication of the user’s wishes.

Overall, the EDPB's insistence that personal data should not be commodified and that the right to data protection should not come at a cost reflects more than a mere echo of the sentiments expressed by privacy advocate Max Schrems; it represents a wholesale adoption of his philosophy. This alignment between Schrems and the EDPB members suggests a tilt towards ethical considerations, which inherently infuses the debate with emotional elements. 

Such a shift places less emphasis on strict legal frameworks and more on the moral implications of data privacy, indicating a profound departure from traditional legal approaches to privacy and data protection, which can be problematic for players trying to comply with the law.

Why the EDPB opinion can be problematic

The EDPB opinion can be considered problematic in many respects, but I will focus today on two main areas: the notion of free alternative and the granularity concept. In this section, let’s highlight some of the shortcomings and limitations exhibited in the opinion for these two points.

Regarding the need for a free alternative:

• Restriction on business freedom: The EDPB opinion can be viewed as potentially limiting businesses’ freedom to choose their revenue models. By recommending against the default use of a paid alternative to avoid behavioral advertising, the EDPB is perceived as dictating terms that could influence how businesses structure their operations and offerings.
• Economic viability of alternatives: The opinion suggests that offering only a paid alternative might not meet the criteria for valid consent and suggests imposing a requirement to provide a free alternative without behavioral advertising (FAWBA). This would have a dramatic impact on the economic models of online publishers in Europe.
• Regulatory overreach: The EDPB is stepping into the role of a market regulator by implying it could assess the appropriateness of fees charged for service access. This could be perceived as beyond the typical regulatory scope of data protection authorities and encroaches on business decision-making freedoms.
• Imposed business modifications: The EDPB's stance on the necessity of providing alternative models would force companies to modify their business models in ways that might not align with commercial viability or strategic business goals.

Regarding the granularity of consent: 

• Complexity in implementation: The EDPB argues that consent should be granular and that data subjects can consent for specific processing operations independently. While commendable, this would be potentially complex and difficult to implement practically, especially in distinguishing between consent for functional aspects of a service and consent for behavioral advertising.
• User experience and service functionality: Offering users the ability to consent to some parts of a service but not others presents important practical challenges. For example, if a user consents to the service's functionality but not to behavioral advertising, it raises questions about how the service could or should be modified to accommodate this partial consent.
• Impact on advertising models: These suggested requirements for granularity could disrupt established advertising models, particularly those that rely on a more integrated approach where advertising and content personalization are closely linked. In turn, this would likely affect the viability of ad-supported business models.
• Operational and compliance challenges: Implementing such granularity in consent mechanisms may pose significant operational and compliance challenges for platforms, potentially leading to increased costs and complexity in service design and offering.

Our conclusion on the EDPB opinion

First and foremost, it’s important to remember that the EDPB document remains an opinion and is thus non-binding. However, it is a fair indication of where European data protection authorities stand on the topic of “Pay or Consent” when it comes to large platforms whilst offering broader implications for all European publishers.

While the original legal proceedings from NOYB specifically targeted Meta, the conversation now challenges the viability of paywall models when using the “Consent or Pay” model. 

This introduces significant potential legal hurdles for publishers, specifically when the proposed increased consent granularity would enable users to reject certain data uses, like personalized advertising, and still be offered the option to access content by paying. Conversely, if users refuse analytics, publishers would be expected not to charge for access, presenting substantial technical difficulties in implementing a Consent Management Platform (CMP). 

The opinion's initial objective was to clarify the conversation, but it appears to have the opposite effect: It foresees a potential complete overhaul of publishers' paywall strategies.