Update | Pay or OK: the EDPB’s Opinion

The European Data Protection Board (EDPB), with an Opinion issued on April 17, has once again expressed its view on the issue of “Pay or OK” – the practice that conditions access to online content on singing up for a subscription or, alternatively, giving consent to the processing of personal data for behavioral advertising purposes – increasingly employed by major online platforms. The EDPB’s Opinion focuses on the validity of consent obtained from users through such a system, which could be compromised by the practical impossibility of enjoying a service without agreeing to be profiled or paying a sum of money.

1. Freedom of consent

The EDPB believes that the Pay or OK models implemented by major online platforms – for which it provides a definition based on the number of platform users and large-scale processing – in most cases, fail to meet the requirements for valid consent, which, according to data protection regulations, must be freely given, specific, informed, and unambiguous. This is because, through such systems, users effectively have to choose whether to consent to personalized advertising, pay a sum of money, or, failing that, forgo the service altogether. This last option could prejudice individuals, especially in the case of services used daily or considered essential, such as a platform disseminating information not easily accessible elsewhere or a job search platform. This prejudice, in the Authority’s opinion, could also exist in the case of social media, exclusion from which may deprive users of social interactions on the platform, leading to social isolation and negatively impacting their emotional and psychological well-being. Additionally, consider the case of content creators or influencers, for whom social media may represent the primary source of income and the foundation of their professional activity: these individuals may feel compelled to give thier consent to profiling in order not to lose their portfolio, followers and, in general, their source of income.

In such cases, furthermore, consent cannot be considered freely given even if the major online platform employing the Pay or OK model has significant market influence, enough to make users believe there are no valid alternatives from other competitors. According to the EDPB, in such a situation, freedom of choice would be subject to the actions of other market operators and the subject’s perception of the parity of service offered by another provider.

For these reasons, the EDPB emphasizes that users can genuinely exercise free choice only if major online platforms – the focus of this opinion – offer, in addition to the current two alternative, an “equivalent alternative” that is free and devoid of profiling for behavioral advertising purposes, such as a version of the service that involves a less intrusive form of advertising than personalized advertising. This is the case of contextual advertising, i.e., advertising linked to the context in which it is displayed.

The EDPB clarifies that, to constitute a real alternative, the alternative version of the service must have the same functions and features as the paid or behaviorally advertising-supported version, as well as possess the same qualities.

The EDPB also reminds that minors should not be the target of behavioral advertising: the proposal of an alternative solution to Pay or OK, therefore, must also be identified in favor of this category of individuals.

2. Consent Requirements

In the Opinion, the EDPB clarifies that platforms employing the Pay or OK model must, in any case, comply with the regulatory requirements for consent and, generally, the principles of personal data protection.

Firstly, consent must be granular: if there are different processing purposes – such as content personalization, service improvement, and audience measurement – consent must be obtained for each of these.

Secondly, it is necessary for the consent given to be informed, and thus, the platform must clearly describe the data processing methods, both regarding the benefits offered to data subjects – i.e., a more personalized experience – and regarding the more invasive consequences. In particular, the EDPB clarifies that major online platforms should provide information regarding: (i) the collection and processing of data retained by the controller regardless of whether the user consents to behavioral advertising and (ii) the combination or cross-use of data, i.e., whether and to what extent data is combined with data collected from other services or third parties.

3. Additional Provisions

Finally, the EDPB clarifies that major online platforms must allow users to withdraw consent at any time without suffering repercussions. In the specific case of the Pay or OK model, revocation of consent requires presenting the user with the choice again to consent to data processing for advertising purposes or to opt for a paid subscription.

Moreover, the EDPB emphasizes that if a user decides to switch from the free version of a service to the paid one, this is equivalent to withdrawing the initially provided consent. On the other hand, if the user cancels the paid subscription, this does not constitute a new consent to data processing.

***

The EDPB’s Opinion on the Pay or OK issue represents a clear signal to online platforms and European legislators about the need to review monetization models that impact the users’ fundamental rights. In Italy, an official position from the Privacy Authority on the issue is still awaited and it could serve as a reference point for national actors.