gdpr & the "consent or pay" model

In the decision of the Court of Justice of the European Union (CJEU) of 4 July 2023 (C‑252/21), Meta’s data monetisation practices were declared unlawful.

This case arises from a request for a preliminary ruling concerning the interpretation of several key provisions of the Treaty on European Union (Article 4(3) TEU) and the General Data Protection Regulation (GDPR), specifically Articles 6(1), 9(1) and (2), 51(1), and 56(1).

The dispute involves Meta Platforms Inc. (formerly Facebook Inc.), Meta Platforms Ireland Ltd. (formerly Facebook Ireland Ltd.), and Facebook Deutschland GmbH, in a case brought by the German Federal Cartel Office (Bundeskartellamt).

- For the lawful processing of personal data under Article 6(1)(f) of the GDPR, three (3) cumulative conditions must be satisfied:

(i) the processing must be based on a legitimate interest pursued by the data controller or a third party;

(ii) the processing must be necessary for the purpose of fulfilling the legitimate interest; and

(iii) the interests or fundamental rights and freedoms of the data subjects must not override the legitimate interests of the data controller or the third party.

- The CJEU underscored that the dominant market position of the data controller is a critical factor in determining whether consent is genuinely valid and, in particular, freely given. This is due to the potential impact of the controller's dominant position on the user's freedom of choice, potentially coercing the user into consenting or preventing the withdrawal of consent without incurring significant negative consequences. Such a situation may create a disproportionate imbalance between the data subject and the controller.

- The CJEU further clarified that, where certain processing operations are not essential for the performance of a contract, users must be free to refuse to consent to such operations without being compelled to abandon the use of the service entirely. If necessary, users must be offered an alternative that, while subject to an appropriate fee, does not involve the same intrusive data processing operations.

- The CJEU emphasized that consent is presumed not to be freely given if it does not allow for separate consent to be provided for different data processing operations, even when it is appropriate in the specific context.

- The CJEU highlighted the significance of factors such as the scale of data processing, the substantial impact of such processing on users, and the reasonable expectations of the users, all of which are critical in the assessment of the case at hand.

- Meta's "Consent or pay" model presents users with a binary choice: either pay a subscription fee for an ad-free experience, or consent to extensive tracking and profiling. This model raises serious concerns regarding the voluntariness and legitimacy of user consent, as it essentially forces individuals to choose between sacrificing either their privacy or their financial resources.

During its plenary on 17 April 2024 , the EDPB adopted an Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms.

This opinion was issued following an Art. 64(2) GDPR request by the Dutch, Norwegian & Hamburg Data Protection Authorities (DPA). It addresses the validity of consent to process personal data for the purposes of behavioural advertising in the context of ‘consent or pay’ models deployed by large online platforms. 

“‘Consent or pay’ models can be defined as models where a controller offers data subjects a choice between at least two options in order to gain access to an online service that the controller provides: the data subject can 1) consent to the processing of their personal data for a specified purpose, or 2) decide to pay a fee and gain access to the online service without their personal data being processed for such purpose. This Opinion will focus on models in which consent can be given to the processing of personal data for behavioural advertising purposes.”

EDPB Guidelines on consent, paragraph 5 reads as follows :

“As the WP29 stated in its Opinion 15/2011 on the definition on consent, inviting people to accept a data processing operation should be subject to rigorous requirements, since it concerns the fundamental rights of data subjects and the controller wishes to engage in a processing operation that would be unlawful without the data subject’s consent.5 The crucial role of consent is underlined by Articles 7 and 8 of the Charter of Fundamental Rights of the European Union. Furthermore, obtaining consent also does not negate or in any way diminish the controller’s obligations to observe the principles of processing enshrined in the GDPR, especially Article 5 of the GDPR with regard to fairness, necessity and proportionality, as well as data quality. Even if the processing of personal data is based on consent of the data subject, this would not legitimise collection of data, which is not necessary in relation to a specified purpose of processing and be fundamentally unfair.”