Large online platforms, such as social media, should not force their users to be tracked on the Internet in order to use the platform. There should be an option where users are not tracked and an option where users do not have to pay and where they are only tracked to a limited extent. So say the Personal Data Authority (AP) and the other privacy regulators in Europe, united in the European Data Protection Board (EDPB).
The AP, along with Norwegian and German privacy regulators, had asked the EDPB to take a position on the issue. This is because some online platforms argue that people can continue to use the platform without payment only if they agree to have their personal data used for targeted ads.
The EDPB argues that it is not a fair choice when users have to choose between a paid subscription without being tracked and a membership that does not require them to pay but does: the 'consent or pay' model. Users are actually forced to choose to 'pay' with their personal data. Especially if the price for a paid subscription is high.
Therefore, the tech companies behind the online platforms should offer a third option. This form of membership should be free. And the user should be able to be tracked only to a limited extent. The ads that users then see are then not based on their behavior across the Internet but are contextual, for example. That means the ads match the content someone is viewing on the platform. For example, an ad for a car accompanying a post about cars.
This will be the standard for tech companies. If companies do not do this, they will have to prove that their practices still comply with the law.
AP Chairman Aleid Wolfsen: 'Privacy is not only for rich people. You should be given a free, fair choice. If a platform threatens to blacklist your online account as soon as you don't agree to be tracked online, that's not a free choice. Tech companies should not be allowed to force you to agree to have your behavior tracked online. To sell your data to ad companies, for example.
Wolfsen continued: "When tech companies charge an unreasonably high price for a privacy-friendly option, they leave people with small wallets no choice. Often they need such a platform. For example, for work or to stay in touch with family. Saying goodbye to the platform is not an option, but neither is coughing up the subscription fee. That is not a choice, that is coercion.'
The General Data Protection Regulation (AVG) requires companies that collect and use personal data to have a legal basis for doing so (1). Such as consent (2). Consent must be freely given, without pressure. You must also have the choice to refuse to allow a company to process your personal data. And that should not have any major adverse consequences.
Wolfsen is pleased with the position the regulators are now taking. 'Large tech companies must abide by the law. This position is crystal clear and helps responsible regulators to intervene harshly when they see a violation.
(1) https://www.autoriteitpersoonsgegevens.nl/themas/basis-avg/avg-algemeen/grondslagen-avg-uitgelegd
(2) https://www.autoriteitpersoonsgegevens.nl/themas/basis-avg/avg-algemeen/grondslag-toestemming
