The events unraveled so far
The landscape of advertising technology is undergoing an unprecedented shakeup, particularly in light of recent events surrounding Meta's operations in the European Union (EU) and European Economic Area (EEA).
On October 27th, 2023, the European Data Protection Board (EDPB) issued a momentous binding decision targeting Meta's processing of personal data for behavioral advertising on its platforms, Facebook and Instagram. With over 250 million active users in the EU/EEA, the impact of this decision is substantial. Originating from a request by Norway's data protection authority, Datatilsynet, the decision reflects deep concerns regarding illegal tracking, monitoring, and profiling activities on these platforms.
As a response, in November 2023, Meta adopted a new ‘pay or okay’ approach. Meta proposed a 'consent' mechanism, allowing users to opt for a monthly subscription to enjoy ad-free experiences or continue with free access supported by behavioral advertisements.
However, this proposition has sparked significant legal and ethical debates, with privacy experts like Max Schrems questioning the implications of commodifying fundamental rights such as data protection. This transition from ad-supported to subscription-based models raises profound questions about accessibility to digital rights and the widening gap between economic privilege and basic freedoms. The Dutch, Norwegian and Hamburg SAs have now requested an EDPB opinion about this approach under Article 64(2) of GDPR.
The EDPB should issue its opinion within eight weeks. However, if necessary, the deadline can be extended by another six weeks, potentially giving the EDPB a total of 14 weeks to process the matter. This opinion will inform the enforcement of the GDPR throughout the EEA.
The joint letter to EDPB
On February 16, 2024, a joint letter from privacy activist Max Schrems' advocacy group NOYB, the Irish Council for Civil Liberties, Wikimedia Europe, the Electronic Privacy Information Centre, and others was submitted to the European Data Protection Board (EDPB) (you can read the press release here and the joint letter here). This correspondence coincides with the EDPB's forthcoming guidance on the consent or pay model, prompted by requests from Dutch, Norwegian, and Hamburg privacy watchdogs seeking the EU privacy regulator's opinion.
The letter, signed by 28 non-governmental organizations and Consumer Rights Organizations, calls for the prohibition of the model, citing concerns that its adoption by other companies could significantly undermine the GDPR and jeopardize individuals' ability to safeguard their privacy without financial constraints. It emphasizes the potential repercussions of creating a scenario where individuals must pay to protect their privacy, labeling it as a dangerous precedent.
Furthermore, the letter highlights the observation that many users may not have the means or inclination to pay for privacy protection, thus limiting genuine choice. It urges Europe's privacy enforcers to resist Meta Platforms' no-ads subscription service, launched in Europe the previous November, as it requires users to pay for privacy—a model likely to be emulated by other companies.
The Addressed Concerns and Meta’s response
As emphatically stated in the joint letter, the 'pay or okay' approach enables any website, app, or consumer-facing company to affix a price tag to the 'reject' option, effectively compelling the vast majority of data subjects to either consent to the use, sharing, or selling of their personal data or incur a fee that can exceed the revenue generated from such data usage by over 100 times.
"If 'pay or okay' is permitted, it will extend far beyond news pages or social networks, being adopted by any industry sector capable of monetizing personal data via consent," stakeholders expressed their concerns as outlined in the letter.
"In practice, this would effectively undermine the GDPR, the esteemed European data protection standard, and erode all meaningful protections against surveillance capitalism", they emphasized, referring to the landmark EU privacy rules established in 2016. Both within and beyond the EU, data subjects rightly question the utility of the GDPR, given the widespread use of manipulative consent banners and 'dark patterns' that undermine their genuine and free choice.
As Meta introduced a paid tier to Facebook and Instagram, offering users in the EU, EEA, and Switzerland the option to opt-out of advertisements for a fee, concerns have arisen regarding the economic impact on individuals. Users are presented with a choice: either pay €12.99 per month (with an additional €8 for each additional social media platform) for an ad-free experience or tolerate promoted content comprising between one-third and one-quarter of their curated news feed.
"We believe that Meta, and other companies likely to adopt similar approaches, are aware that a majority of users will neither have the means nor the inclination to pay a fee", the letter continued. Given that 'pay or okay' results in a consent rate of over 99.9%, critics question the legality of charging up to €251.88 per year for clicking a reject button, particularly when compared to less intrusive consent mechanisms such as moving the 'reject' option to a secondary layer or utilizing a pre-ticked box. “Such a business model transforms privacy into a luxury rather than a fundamental right, reinforcing existing discriminatory practices that restrict access to the digital realm and control over personal data.”
Meta reiterated its stance, emphasizing that its subscription service for ad-free experiences on Facebook and Instagram is designed to comply with EU regulations by offering users a choice regarding the collection and utilization of their data for targeted advertising. A Meta spokesperson clarified that the subscription model aligns with guidance and judgments from leading European regulators and courts, citing the Court of Justice of the European Union's endorsement of such models as a means for individuals to consent to personalized advertising data processing.
The preposition
The stakeholders strongly urge the European Data Protection Board (EDPB) to issue a decision on the subject that aligns with the Fundamental Right to Data Protection. Therefore, they implore the EDPB and all Supervisory Authorities (SAs) to firmly oppose the 'pay or okay' model to prevent the creation of a significant loophole in the GDPR.
The opinion of the EDPB will profoundly shape the future of data protection and the internet for years to come. It is imperative that the opinion genuinely ensures data subjects a 'genuine and free choice' regarding the processing of their personal data.
Privacy Minders remains committed to keeping our clients abreast of the evolving news sequence. We encourage businesses to reach out for a consultation should they anticipate any potential impacts on their business models while navigating the complexities of data protection regulations and the advertising landscape.
Written by Loukis Mavris