On 6 March 2024, the ICO launched a consultation inviting organisations and other stakeholders such as advertisers, academia and publishers to provide views on the controversial “consent or pay” business model, also known as “pay or okay”. Under the “consent or pay” model, online service providers offer service users a choice to access a service at no additional cost if they consent to their personal data being used for personalised advertising, or, if they decide not to consent, users pay a fee, or higher fee, to access the service.
The ”consent or pay” model was adopted by Meta in Europe in November 2023. Under Meta’s “pay or ok” policy, EU service users are asked to either provide consent to their personal data being used for personalised advertisements or subscribe to an ad-free service priced at €9.99 for web users and €12.99 for mobile users.
Meta’s move to “pay or okay” has caused uproar amongst privacy advocates in the region who argue that the concept is incompatible with data protection law and at odds with the GDPR principle of “freely given” consent based on “genuine ongoing choice”.
The ICO’s initial opinion is that, in principle, “consent or pay” is not prohibited by data protection law. However, service providers considering implementing this policy would be required take a privacy by design approach which ensures valid consent is obtained from service users in accordance with the requirements of GDPR. The Supervisor has suggested that organisations consider the following:
- Whether an imbalance of power exists between the organisation and its service users? This may occur where the service provider occupies a dominant market position and consent may therefore not be freely given.
- Whether the ad-funded service and paid service are essentially the same?
- The level of fee charged, which should not be excessively high. A high fee is likely to remove a realistic choice for service users who can’t afford or are unwilling to pay an expensive “privacy tax”.
- The requirement to provide service users with clear, understandable information about their choices remains and perhaps is even more critical when presenting a new “consent or pay” policy to existing service users who heavily rely on particular services and are accustomed to the service user’s current approach. implementing the new policy could create a power imbalance that did not previously exist.
These issues are being scrutinised not only by the ICO but also by Data Protection Authorities in Norway, Netherlands and Hamburg which have each called on the European Data Protection Board to issue its opinion on the matter. It is not yet known what direction these discussions will take, but UK organisations that are ad-funded and rely on online advertising will no doubt be eagerly awaiting the outcome of the ICO’s consultation and clarity as to whether there is a GDPR compliant route to “consent or pay”.
The ICO has stated that they will continue to develop their views on the proposal and their consultation remains open until 17 April 2024. Views can be submitted here: www.smartsurvey.co.uk/s/Consent_or_Pay
