For years, many ad-funded online services have relied on advertising technologies (such as third party cookies) and personal data processing activities to personalise the ads that their users see. Put simply, advertisers are more willing to purchase advertising space where users are more likely to be interested in their ads, and as a consequence those online services can achieve a better price for their digital advertising space.
However, that model is frequently at odds with a data protection regime that sometimes expressly requires consent (for example, where cookies or other similar technologies are used to store or access information on a device) and elsewhere has been interpreted to restrict the ability to rely on lawful bases other than consent (such as performance of a contract or legitimate interest) to process personal data for ads related purposes.
The upshot is that many of these online services are under more pressure than ever to obtain consent from their users to personalise ads. However, obtaining a valid consent under the UK/EU GDPR is easier said than done, with the ICO recently warning organisations to make changes to the way that they collect consent, including ensuring that users can easily withhold consent through prominent ‘Reject All’ buttons on cookie banners.
So, how to move forward? Can these online services offer users two (or three) choices – pay a subscription for the service or consent to processing (or don’t use the online service) – so called ‘Pay or Okay’ or ‘Pay or Consent’? Does this model meet UK/EU GDPR requirements for consent to be ‘freely given’?
That’s the €86 billion question that’s on the minds of many.
Privacy activists consider the approach to be an “attempt to circumvent EU privacy laws” and, in effect, a “privacy fee” which will result in the fundamental right to privacy being “reserved for the rich”.
However, to date the regulatory response has been mixed. Some supervisory authorities in Europe (in particular, Austria) appear receptive to the model, and the ICO says that it is working with online services to find a solution, including subscription models.
Therefore, three EU supervisory authorities are now calling for much needed clarity and consensus by asking the European Data Protection Board (EDPB) to issue an opinion on the matter. However, there are no prizes for guessing the position of those three supervisory authorities, which ask the loaded question: “Is data protection a fundamental right for everyone, or is it a luxury reserved for the wealthy?”, and note that the approach may be particularly problematic when it comes to “large and popular online services with many users”.
It will be interesting to see where the EDPB (and, no doubt eventually, the CJEU) land on this important question, though anyone hoping for a simple solution may be disappointed, with previous comments from the EDPB on the topic suggesting that the model will require users to be offered a third option (such as non-personalised or contextual advertising) in addition to a subscription or personalised advertising (see quote below). This suggestion seems to widely miss the mark and is unlikely to cut the mustard with any online service that survives on the better revenues that can be achieved from personalised advertising.
When assessing whether consent is valid, the EDPB considers it among others relevant whether in addition to a service using tracking technology and a paid service, another type of service is offered, for example a service with a less privacy intrusive form of advertising, such as contextual advertising, and whether the data subject is able to exercise a real choice.
unknownx500
