The EDPB’s Stance on the Pay or Okay Model

Interesting developments concerning data protection in the EU!

As you may recall, in December 2023, we published a comprehensive guide on the “Pay or Okay” model introduced by Meta in response to several legal challenges regarding its use of lawful grounds for processing users’ data for behavioural advertising (read more about it here).

We concluded the discussion with the European Data Protection Board (EDPB) committing to review the proposal and deliver a verdict. Fast forward to this week, the EDPB has finally delivered its decision on “Pay or Okay” in relation to large online platforms (available here)

EDPB’s Position

The EDPB’s stance is clear: “Personal data cannot be considered as a tradeable commodity, and controllers should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy.”

In its detailed opinion, the EDPB reaffirms the primacy of the fundamental right to data protection, emphasizing that individuals should never find themselves in a position where they must pay to exercise this right. While the EDPB refrains from an outright prohibition of fees, it imposes stringent criteria to ensure that individuals can provide consent freely, devoid of any coercion or undue influence.

Central to the EDPB’s stance is the notion that any fee imposed should not act as a barrier, effectively discouraging individuals from making a free choice. This becomes especially critical in the context of large online platforms, where participation often feels obligatory for social connectivity or professional engagement.

Free Alternative Without Behavioural Advertising

Additionally, key to the EDPB’s position is the requirement for an additional option that breaks the “Pay or Okay” dichotomy. According to the EDPB, the availability of a so-called “Free Alternative Without Behavioural Advertising” is a crucial factor in determining whether individuals can genuinely exercise their choice, and thus, whether consent is valid. The inclusion of the Free Alternative without Behavioural Advertising serves a vital purpose in addressing any potential harm to users who opt out of data processing or are unable to pay for access to the service.

Controllers must ensure that: (1) the free alternative offers similar functionalities and does not disadvantage non-consenting users; (2) transparent communication and user-friendly interface design are essential to ensure that users fully comprehend their options.

Further Consequences

In addition, the EDPB underscores that the ramifications of the “Pay or Okay” model extend beyond mere choice constraints. It also explains the consequences to other fundamental data protection principles, notably the principle of purpose limitation, fairness, data protection by design and by default, and accountability.

Conclusion

In conclusion, the EDPB does not outright prohibit the use of a “Pay or Okay” model for behavioural advertising practices. However, it contends that such models are only acceptable if platforms can substantiate, in accordance with the principle of accountability, that all criteria for valid consent are fulfilled.