Processing Data for Behavioural Advertising: Meta’s Use of GDPR’s Legal Bases and the New Pay or Okay Model

Would you be willing to pay for the preservation of your privacy? This is the inquiry Meta presents to its Facebook and Instagram users, offering not to track their behaviour for advertising at the cost of €9.99/month on the web or €12.99/month on iOS or Android.

This so-called “Pay or Okay” is being implemented by Meta in response to numerous legal decisions challenging its use of lawful grounds for processing users’ data for behavioural advertising.

Initially relying on “contractual necessity” under Article 6(1)(b) GDPR, this approach was dismissed by the European Data Protection Board (EDPB) and the Irish Data Protection Commission (DPC), as online behavioural advertising was deemed non-essential for the fulfillment of online service contracts. Additionally, it conflicted with data subjects’ inherent right to object to processing for direct marketing.

Subsequent to this decision, Meta opted for “legitimate interest” under Article 6(1)(f) GDPR as its new legal basis. However, the Court of Justice of the European Union (CJEU) invalidated this new legal basis in Meta vs Bundeskartellamt.

Meta’s repeated breaches of the principle of lawfulness raised concerns among national authorities. As a result, the EDPB issued a binding decision instructing the Irish DPC to take decisive measures, imposing a ban on Meta’s processing of personal data for behavioural advertising based on contractual necessity and legitimate interest across all EU/EEA.

Due to these developments, Meta announced the “Pay or Okay” model, currently under discussion by the EDPB and subject to objections by various entities.

Read our comprehensive document designed to navigate you through Meta’s adherence to the GDPR’s principle of lawfulness in the processing of data for behavioural advertising here: Processing Data for Behavioural Advertising