Written Evidence to the ICO on the ‘Consent or Pay’ Model

Dr Ann Kristin Glenster

22 April 2024

Summary of Written Evidence

1. This is a written submission of evidence to the Information Commissioner’s Office’s (“ICO”) consultation for views on the “consent or pay” model, closing 17 April 2024. This submission was updated on 22 April 2024 to take account of the European Data Protection Board’s (“EDPB”) Opinion 08/2024 on the consent or pay model, adopted on 17 April 2024.^[1]

2. This submission is made by the Minderoo Centre for Technology and Democracy, an independent team of academic researchers at the University of Cambridge, who are radically rethinking the power relationships between digital technologies, society, and our planet.

3. The ICO is calling for views on the proposed “consent or pay” mechanism. According to Stephen Almond, Executive Director of Regulatory Risk at the ICO, this model “gives people the choice to use a website for free, but only if they consent to their personal information being used for personalised advertising, or pay a fee and not be tracked.”^[2] 

4. In our remarks, we only address the two first questions asked by the ICO:

1. Do you agree with our emerging thinking on “consent and pay”?
2. How helpful are the indicative factors in comprehensively assessing whether “consent or pay” models comply with relevant law?

5. In this submission, we argue that the proposed model offers users a choice between two different requests for consent, both of which must comport fully with the General Data Protection Regulation (“GDPR”) to fulfil the legal requirements under the Data Protection Act 2018.^[3] 

6. Whether a user pays for a service is irrelevant from the perspective of data protection as an individual cannot, through contract, alleviate a data controller of their fundamental rights obligations. Thus, the ICO will need to consider whether the pay option also independently meets the conditions for consent as set out in Article 4(11) and 7 GDPR.^[4] 

7. We agree with the EDPB guidelines that a pay model is unlikely to be suitable for large online platforms because personal data should not be treated as a commodity on fundamental rights and fairness grounds, and because behavioural advertising is a particularly intrusive form of advertising which should therefore, in our view, be banned.

Do you agree with our emerging thinking on “consent and pay”?

8. According to the ICO: 

“[i]n principle, data protection law does not prohibit business models that involve ‘consent or pay.’ However, any organisation considering such a model must be careful to ensure that consent to processing of personal information for personalised advertising has been freely given and is fully informed, as well as capable of being withdrawn without detriment.” ^[5]

9. In its call for evidence submissions, the ICO explained that it will look at “consent or pay” proposals in terms of how organisations: (1) ensure what they want to do is focused on people’s interests, rights, and freedoms; (2) evidence that people are fully aware of what happens when they interact with an online service; and (3) show that people are making informed, free choices about whether to engage or not.”^[6]

10. Since first announced by Meta Platforms on 30 October 2023,^[7] the proposed “consent or pay” model has been heavily criticised by civil society organisations, academics, and regulators.^[8] The announcement followed two Urgent Binding Decisions by the EDPB which banned the use of Article 6(1)(b) GDPR (necessary for the performance of contract) and Article 6(1)(f) GDPR (legitimate interest) as legal bases for the processing of personal data for the purpose of behavioural advertising.^[9] 

11. According to the former Article 29 Working Party (“29WP”):

 “… behavioural advertising is based on data that is collected through observing the users’ activity over time (e.g., from the pages they visit, the amount of time they spend on a page displaying a certain product, the number of reconnections to a page, the likes given or their location.). In these cases, the monitoring of users takes place through the use of cookies or other similar tracking technologies (e.g., social plug-ins or pixels).”^[10]

12. The forerunner to the EDPB’s Urgent Binding Decisions was the decision by the Norwegian Data Protection Supervisor (“NO DPA”) to ban targeted advertising. Meta brought the matter to a Norwegian Court, which upheld the NO DPA’s decision in September 2023.^[11] 

13. Meta responded by shifting the legal basis for processing to Article 6(1)(a) GDPR (consent) and in so doing also gave its users a choice to either consent to having cookies trace and use their personal data for behavioural advertising, or to pay a subscription fee to avoid their personal data being commodified for that purpose. Specifically, “Meta will offer people in the EU, EEA, and Switzerland the choice to pay a monthly subscription to use Facebook and Instagram without any ads. They can alternatively continue to use these services for free while seeing ads that are relevant to them.”^[12]

14. The reactions to the announcement were immediate. The EDBP issued an urgent Binding Decision banning “Meta’s data processing for behavioural advertising.”^[13] The Decision followed the EDPB’s Binding Decision issued to Meta in December 2022 which “clarified that contract is not a legal suitable for processing of personal data carried out by Meta for behavioural advertising.”^[14]

15. In February 2024, civil society organisations wrote to the EDPB asking for an Opinion that would recognise the ‘consent and pay’ model as illegal.^[15] The petitioners argued that the model was in contravention of Article 4(11) GDPR (setting out the definition of consent), Recital 42 GDPR, the EDPB’s Guidelines 05/2020,^[16] and the Court of Justice of the European Union’s (“CJEU”) decision regarding a German case (“Bundeskartellamt”) of 4 July 2024.^[17] They also argued that it would set a new industry standard, that the economics were different than for news publishers, and that it contravened several human rights, including those set out in the EU’s Charter of Fundamental Rights and Freedoms (CFR).^[18] 

16. One letter explained that:

“By forcing people to purchase their own rights, these subscription systems normalise a transformation of rights into commodities. They shift the narrative on which human rights were created, challenging their inalienable nature and the principle that they are intrinsic to a person by the very fact of human existence. Putting our right to privacy up for sale directly compromises the essence of the right and compromises the essence of human rights in general. No one can sell our rights because they are by definition, inalienable.”^[19]

Analysis

17. With this summary in mind, we make the following comments to the ICO’s emerging thinking on the “consent or pay model” to ensure that the regulatory guidance comports with the GDPR as mandated by the Data Protection Act 2018:

18. When considering the options for legal bases under Article 6 GDPR, the EDPB and the courts have only left the option of Article 6(1)(a) GDPR (consent) for the use of personal data in behavioural advertising. This also tallies with the consent requirement under the Privacy Directive regarding the use of third-party tracking cookies.^[20]  Whether there is a payment as a contractual matter is therefore irrelevant.

19. For clarity, we recognise that the CEJU suggested that a pay model could be used if there was an “equivalent alternative” and “if necessary for an appropriate fee.”^[21] We maintain that the correct interpretation is not that a fee can be bundled with consent as a legal basis under Article 6(1)(a) GDPR, but that the reference to a fee is a separate condition that falls under the domain of contract.

20. Thus, the only way to see this model as legal under the GDPR would be to see it as two options of consent: (1) consent with permission to use personal data for behavioural advertising and (2) consent to use personal data only as far as it is not processed for personal advertising. Both would have to comport with all GDPR stipulations concerning consent as set out in Articles 4(11) and 7 GDPR and Recital 42 GDPR.

21. If this analysis is correct, the question is not whether individuals should be allowed to pay to ensure that their personal data is not used in behavioural advertising, but whether this is framed as a consent (as different from a ‘mere’ purchasing) option to the user. In other words, for the pay option to be legal, it would have to be presented as two separate issues: (1) the contract for the purchase of online services behind a paywall – governed by contract and therefore outside the remit of the ICO; and (2) a request for processing of personal data. In other words, these two operations cannot be bundled into one.^[22] 

22. This analysis comports with the EDPB’s Opinion 08/2024 on the consent or pay model.^[23] According to the EDPB, it was unlikely that a binary choice between a consent option and a pay option would meet the legal requirements because the CJEU’s requirement of an ‘equivalent alternative’ did “not entail the payment of a fee.”^[24] The EDPB noted that the CJEU in Bundeskartellamt had not stated that consent or pay models were illegal, and indeed had allowed for these models to be used when there was “an equivalent alternative” and “if necessary, for an appropriate fee.”^[25] Thus, the EDPB stated that:

“controllers should assess, on a case-by-case basis, both whether a fee is appropriate at all and what amount is appropriate in the given circumstances, bearing in mind the requirements of valid consent under the GDPR as well as the need of preventing the fundamental right to data protection from being transformed into a feature that data subject’s have to pay to enjoy, or a premium feature reserved for the wealthy or the well-off.”^[26]

23. The last point also addresses the requirement of fairness under Article 5(1)(a) GDPR.^[27] While there may be many reasons why an individual would wish to see behavioural advertising, the use of behavioural advertising also raises issues of fairness, especially in cases where users may feel they cannot afford to access a product unless they ‘pay’ with their personal data. In such cases, there is likely to be a violation of Articles 7 (privacy) and 8 (data protection) CFR.

24. The EDPB furthermore noted the likely power imbalance between users and large online platforms, which could be “decisive for participation in social life or access to professional networks,” where a pay option did not present a free choice.^[28] The EDPB also highlighted that this would likely be the case where a user had started to use the platform services for free, and thus a switch to a pay option would not meet the user’s reasonable expectation.^[29] Thus, for the EDPB, an equivalent alternative should include an alternative that did not entail the payment of a fee.^[30]  Accordingly, “… in most cases it will not be possible for large online platforms to comply with the requirement for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.”^[31]

25. Furthermore, the EDPB stated in its Opinion 08/2024 that:

“Several processing activities take place when controllers process personal data for behavioural advertising purposes. These include monitoring of data subjects’ behaviour, gathering personal data and analysing them for the purpose of creating and developing users’ profiles, sharing personal data with third parties as part of the creation and development of users’ profiles or to connect advertisers with publishers, serving data subjects with ads personalised on the basis of the resulting profile, and analysing the users’ interaction with the advertisements displayed based on their profile. For these reasons, behavioural advertising is considered a particularly intrusive form of advertising, as it can provide controllers with a very detailed picture of individuals’ personal life.”^[32]

26. In conclusion, while some commentators see the issue of fairness as an issue of finding the right price (“appropriate fee”),^[33] we support the view that any suggestion that personal data being used as a payment mechanism is a violation of the fundamental rights and freedoms of an individual and should therefore be banned. As such, the consent option whereby individuals consent to having their personal data commodified for behavioural advertising purposes should be banned simply because it would be anathema to human rights doctrine to permit individuals to trade inalienable fundamental rights protection, such as data protection and privacy, in exchange for goods and services. This is also the view of the EDPB, which wrote that “personal data cannot be considered a tradable commodity” and that “controllers should bear in mind the need of preventing the fundamental rights to data protection from being transformed into a feature that data subjects have to pay to enjoy.”^[34]

How helpful are the indicative factors in comprehensively assessing whether “consent or pay” models comply with relevant law?

27. The ICO lists the following indicative factors: (1) power imbalance; (2) equivalence; (3) appropriate fee; (4) privacy-by-design; (5) information given to users; and (6) the right to withdraw consent. We only have short comments to factors 1, 2, 5, and 6 as these are already clearly set out in the GDPR. Whether there is a power imbalance or equivalence are matters of fact, not law, and thus outside the scope of our comments. The information to users and the right to withdraw consent would apply regardless of the use of a “consent or pay” model and therefore does not engage unique issues to be discussed here. The EDPB has discussed factors 5 and 6 at length,^[35] so there is no need to repeat that discussion here.

28. As regards factor 3, the suggestion that consent somehow can be determined by an assessment of the appropriate fee is a misunderstanding of the nature of the legal bases in Article 6 GDPR. While we recognise that the Danish and French DPAs have suggested that the concept of an appropriate fee can be used to determine whether consent was “freely given,”^[36] it is our opinion that whether there are fair terms and conditions for payment is a matter for the law of contract, not data protection. While the data processing principle includes a legal requirement of fairness (Article 5(1) GDPR), the perception of fairness on the part of a regulator as an external party cannot substitute the conditions for consent as freely given by the individual as set out in Article 4(11) GDPR and Article 7 GDPR. We therefore consider that the factor of appropriate fee is irrelevant in the assessment of whether “consent or pay” is legal under the GDPR for reasons stated in paragraphs 19, 22, and 24 of this submission.

29. As regards factor 4, the “consent or pay” model may fail to comply with Article 25 GDPR on data protection by design and default, especially if it is found to be equivalence between these two services. In that case, one service would comply by offering more data protection in exchange for monetary payment, while the other would offer less data protection for the same service. This would mean two different levels of data protection, where one clearly would not offer protection by default. In this context, it is worth pointing out that privacy-by-design is a different concept to data protection by design and default, and thus the data protection standard here would be higher because it is not simply about keeping personal data pseudonymised or hidden from certain parties.

Concluding Remarks

30. The announcement by Meta to impose a “consent or pay” model on their users is no surprise following the decisions by the CJEU and the EDPB, which practically only leave consent (Article 6(1)(a) GDPR) as the legal basis available for behavioural advertising. By adopting this new model, Meta is attempting to formalise the controversial “free Internet services in exchange for personal data” approach. However, doing so will bring about a cascade of consequences, not only for data protection, but also for contracts, as such a change will engage a wide set of consumer protection laws.

31. We agree with the EDPB that as data protection is a fundamental right, guaranteed in the CFR, the DPAs must push back on this attempt at the formal commodification of personal data. We also agree with the objections to the “consent and pay” model based on concerns over fairness and access to services.

32. While there are different views among the European DPAs, we expect that they will adopt a unified approach following the EDPB Opinion. Should the ICO choose to go in a different direction, it would likely widen the gap between the UK’s data protection regime and the interpretation of the GDPR in the EU. Such a development could place the UK’s adequacy status at risk, which would have a profound effect on UK organisations and businesses.

33. We therefore recommend that the ICO aligns its guidelines with the EDPB’s Opinion 08/2024 in full.

Bibliography

Access Now, Open Letter to the European Data Protection Board: Oppose “Pay or Consent models,” 7 March 2024 (https://www.accessnow.org/press-release/open-letter-to-edpb-pay-or-consent/#:~:text=As%20such%2C%20%E2%80%9CPay%20or%20Consent,for%20which%20it%20was%20created)

Article 29 Working Party (“29WP”), Opinion 02/2010 on online behavioural advertising, adopted on 22 June 2010, p.  (chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://ec.europa.eu/justice/article-29/documentation/opinion-recommendation/files/2010/wp171_en.pdf)

Charter of Fundamental Rights of the European Union, OJ C 326 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A12012P%2FTXT)

CNIL, “Cookie Walls: la CNIL publie des premiers critėres d’évaluation,” 16 May 2022 (https://www.cnil.fr/fr/cookie-walls-la-cnil-publie-des-premiers-criteres-devaluation)

Court of Justice of the European Union (“CJEU”), C-252/21 (“Bundeskartellamt”), 4 July 2024, ECLI:EU:C:2023:537 (https://curia.europa.eu/juris/documents.jsf?num=C-252/21)

Datatilsynet, “Cookie walls” (https://www.datatilsynet.dk/hvad-siger-reglerne/vejledning/cookies/cookie-walls)

Joseph Duball, “EDPB issues binding decision banning Meta’s targeted advertising practices,” IAPP, 1 November 2023 (https://iapp.org/news/a(edpb-issues-binidng -decisions-banning-metas-targeted-advertising-practices)

European Convention of Human Rights and Fundamental Freedoms 1950 (https://www.echr.coe.int/documents/d/echr/convention_ENG)

EDPB, Guidelines 05/2020 on consent under Regulation 2016/679 (https://www.edpb.europa.eu/sites/default/files/files/file1/edpb_guidelines_202005_consent_en.pdf)

EDPB, Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platoforms, Adopted 17 April 2024 (chrome-extension://efaidnbmnnnibpcajpcglclefindmkaj/https://www.edpb.europa.eu/system/files/2024-04/edpb_opinion_202408_consentorpay_en.pdf)

Forbrukerrådet, Complaint to Datatilsynet under Article 77(1) of the European General Data Protection Regulation, 29 February 2024 (https://storage02.forbrukerradet.no/media/2024/02/2024-02-29-klage-pa-meta.pdf)

ICO, “ICO launches ‘consent or pay’ call  for views and updates on cookies compliance work”, 6 March 2024 (https://ico.org.uk/about-the-ico/media-centre/news-and-blogs/2024/03/ico-launches-consent-or-pay-call-for-views-and-updates-on-cookie-compliance-work/)

Meta, “Facebook and Instagram to Offer Subscription with No Ads in Europe”, 30 October 2023, updated 4 December 2023 (https://about.fb.com/news/2023/10/facebook-and-instagram-to-offer-subscription-for-no-ads-in-europe/)

Meta Platforms Ireland Limited v Staten v/Datatilsynet, case 23-114365TVI.TOSL/08 and 23-114359TV-TOSL/O8, Tingretten decision 06 September 2023

Privacy and Electronics Communications (EU Directive) Regulations 2003 (https://www.legislation.gov.uk/uksi/2003/2426/pdfs/uksi_20032426_en.pdf)

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (Text with EEA relevance) OJ L 199 (https://eur-lex.europa.eu/eli/reg/2016/679/oj); Data Protection Act 2018 (https://www.legislation.gov.uk/ukpga/2018/12/contents/enacted)

Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Service Act (Text with EEA relevance) PE/30/2022/REV 1, OJ L 277 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32022R2065)

Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act) (Text with EEA relevance) PE/17/2022/REV/1, OJ L 265 (https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32022R1925)

Universal Declaration of Human Rights 1948 (https://www.un.org/en/about-us/universal-declaration-of-human-rights)