Privacy has taken centre stage, becoming a top priority for both businesses and regulators. With stricter data protection laws like GDPR coming into play, companies are finding new ways to stay compliant while keeping their business models intact. One such approach is the 'consent or pay' model. "Consent or pay," also known as "pay or OK," is a business model where businesses provide individuals with a choice: access online services for free if they consent to their personal data being used for personalised advertising, or pay a fee to access the same service without data usage for that purpose. This model offers users the option to either consent to their personal data being processed for targeted advertising or pay a fee to avoid such data usage.

On April 17, the European Data Protection Board (EDPB) announced in a news release that it has adopted Opinion 08/2024 regarding "consent or pay" models used by Large Online Platforms (LOPs) for behavioural advertising. The key points from the EDPB’s Opinion are summarized as follows:

• The EDPB asserts that "consent or pay" models generally do not meet the requirements for valid consent under the General Data Protection Regulation (GDPR).
• Personal data should not be treated as a tradeable commodity, and individuals should not have to pay to enjoy the fundamental right to data protection.
• LOPs are advised to develop an "equivalent alternative" that does not require users to consent to the processing of their personal data for behavioural advertising.
• Consent cannot be considered freely given if users suffer detriment by either not providing consent or withdrawing consent. Detriment may also occur if users are excluded from prominent online services for choosing neither to pay a fee nor provide consent for their personal data to be processed for behavioural advertising, and if they are not offered an equivalent alternative.

The EDPB provides guidelines to ensure an alternative is genuinely equivalent, such as omitting processing operations that are unnecessary for the provision of the service and ordinarily rely on consent.

The EDPB’s opinion continues the trend of regulatory scrutiny regarding “consent or pay” models. On the same day the Opinion was published, the ICO closed its call for views on the “consent or pay” business models in the context of its cookie compliance work.

Meta's Approach 

Meta is a key player in the privacy arena due to its vast data collection. To meet regulatory and user demands, Meta is exploring new consent frameworks. An IAPP article notes several key considerations:

• Granularity in Consent: Meta needs to provide clear and specific choices about data sharing, ensuring users understand how their data will be used.
• User Experience: Implementing a user-friendly consent management platform that meets compliance requirements is crucial. The platform should be easy to navigate without overwhelming users.
• Regulatory Alignment: Meta's consent framework must meet GDPR's stringent requirements, ensuring consent is "freely given, specific, informed, and unambiguous."
• Practical Implementation: Rolling out these changes globally involves significant technical and operational updates, including privacy policies, user interfaces, and backend systems. (Meta's new digs: A deep dive into practical considerations of consent)

Other Examples

• Spotify: Users can either listen to ads or pay for a premium, ad-free experience, offering a choice based on privacy preferences.
• YouTube: Offers YouTube Premium, which removes ads for a monthly fee, providing an ad-free, privacy-respecting experience.
• The New York Times: Uses a subscription model to provide ad-free content, ensuring user privacy.
• TikTok: Exploring similar models where users can either consent to personalized ads or opt for a subscription to avoid ads.
• Hulu: Offers both ad-supported and ad-free subscription plans, allowing users to choose based on their privacy preferences and willingness to pay.

Beyond Social Media and Entertainment

The 'consent or pay' model isn't confined to social media and entertainment; other industries are adopting similar approaches. For instance:

• Online Retailers: Some e-commerce platforms offer ad-free browsing or exclusive deals for users who opt to pay a subscription fee, ensuring a more private shopping experience.
• Educational Platforms: Online learning services may provide an ad-free experience or additional resources for a subscription, catering to users who prefer not to have their data tracked.
• Health Apps: Certain health and wellness apps offer premium versions with enhanced privacy controls, appealing to users concerned about the sensitivity of their health data.

By broadening the scope of 'consent or pay' models, companies across various sectors can better meet the privacy expectations of their users while finding new revenue opportunities.

Opportunities for Businesses

The 'consent or pay' model offers several benefits:

• Revenue Generation: Monetize services by offering an ad-free or premium content experience for a fee, attracting privacy-conscious users.
• Enhanced User Trust: Transparency in data usage builds trust, leading to increased loyalty and retention.
• Regulatory Compliance: Helps align with data protection regulations, reducing legal risks and demonstrating a proactive privacy approach.

Challenges to Consider

Despite its advantages, the 'consent or pay' model has challenges:

• User Resistance: Some users may be unwilling to pay or consent, potentially reducing the user base.
• Implementation Complexity: Developing robust consent mechanisms and payment systems requires significant investment.
• Legal and Ethical Issues: Companies must ensure fairness and transparency to avoid ethical pitfalls and comply with legal standards.
• Market Competition: Free services from competitors may attract users who are reluctant to pay, necessitating continuous innovation to retain users.

Conclusion

The 'consent or pay' model is a strategic response to the increasing demand for data privacy and regulatory compliance. It offers opportunities for revenue generation and enhanced user trust but also presents implementation and acceptance challenges. For DPOs and CPOs, understanding these models is crucial for effective privacy strategy implementation that aligns with business goals and regulatory requirements. As the digital landscape evolves, this model is likely to become more common, shaping the future of data privacy and user engagement.

References:

1. Meta's new digs: A deep dive into practical considerations of consent
2. 'Consent or Pay' Models: EDPB adopts Opinion - Wiggin LLP