On 17 April 2024, the EDPB issued its eagerly-awaited Opinion on the use of so-called ‘Pay or Okay’ consent models by ‘large online platforms’ for the collection of consent to process personal data for behavioural advertising purposes. 

Whilst the EDPB opinion is limited to the use of such models when adopted by large online platforms (i.e. Meta and others) and a further, more general, opinion is anticipated, the EDPB say that the factors highlighted in the opinion may apply more generally to others that choose to operate this model.

As we anticipated, the EDPB have suggested that in most instances large online platforms will need to offer users a third option that doesn’t entail payment in addition to paying a subscription or giving consent to behavioural advertising. Such an alternative should involve the processing of less (or no) personal data (e.g. contextual advertising) – which effectively defeats the purpose of Pay or Okay models.

Amongst other factors, the EDPB highlights that detriment may arise where non-consenting individuals do not pay a fee and are therefore excluded from the service, especially where the service has a prominent role, or is decisive for participation in social life or access to professional networks. 

Many businesses and proponents of Pay or Okay models will no doubt feel that the EDBP has not struck the right balance here, and will point to Recital 4 of the GDPR which makes it clear that privacy is not (and never has been) an absolute right and it must be balanced against other rights, including freedom of expression and information, and freedom to conduct a business. Businesses need to monetise their services in some way, and many hoped Pay or Okay would path a harmonious way forward. However, the EDPB in effect rejects that line of reasoning: “personal data cannot be considered as a tradeable commodity, and controllers should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy”.

So, what next? The ICO recently concluded its own consultation on Pay or Okay, and a statement on its policy position is awaited. The EDPB have also stated that they will develop guidelines on ‘consent or pay’ models with a broader scope (i.e. not just limited to large online platforms), and the European Commission are also considering whether Meta’s implementation of Pay or Okay is compliant. It also remains to be seen whether this latest opinion will be put to the test by large online platforms, though ultimately it seems inevitable that a referral to the CJEU will be made on the validity of these models. Watch this space!