Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms.
The Dutch, Norwegian and German (Hamburg) supervisory authorities requested the EDPB to issue an opinion on the question of under which circumstances and conditions ’consent or pay’ models relating to behavioural advertising can be implemented by large online platforms in a way that constitutes valid, and in particular freely given, consent, also taking into account the judgment of the Court of Justice of the European Union (CJEU) in C-252/21. The scope of this opinion is indeed limited to the implementation by large online platforms (which are defined for the purposes of this opinion) of ‘consent or pay’ models where users are asked to consent to processing for the purposes of behavioural advertising.
In this respect, the EDPB highlights the need to comply with all the requirements of the GDPR, in particular those for valid consent, while assessing the specificities of each case. Of particular importance is the principle of accountability. The EDPB recalls that obtaining consent does not absolve the controller from adhering to all the principles outlined in Article 5 GDPR, as well as the other GDPR obligations. It is key to comply with the principles of necessity and proportionality, purpose limitation, data minimisation, and fairness.
In most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.
The offering of (only) a paid alternative to the service which includes processing for behavioural advertising purposes should not be the default way forward for controllers. When developing the alternative to the version of the service with behavioural advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee. If controllers choose to charge a fee for access to the ‘equivalent alternative’, controllers should consider also offering a further alternative, free of charge, without behavioural advertising, e.g. with a form of advertising involving the processing of less (or no) personal data. This is a particularly important factor in the assessment of certain criteria for valid consent under the GDPR. In most cases, whether a further alternative without behavioural advertising is offered by the controller, free of charge, will have a substantial impact on the assessment of the validity of consent, in particular with regard to the detriment aspect.
With respect to the requirements of the GDPR for valid consent, first of all, consent needs to be ‘freely given’. In order to avoid detriment that would exclude freely given consent, any fee imposed cannot be such as to effectively inhibit data subjects from making a free choice. Furthemore, detriment may arise where non-consenting data subjects do not pay a fee and thus face exclusion from the service, especially in cases where the service has a prominent role, or is decisive for participation in social life or access to professional networks, even more so in the presence of lock-in or network effects. As a result, detriment is likely to occur when large online platforms use a ‘consent or pay’ model to obtain consent for the processing.
Controllers also need to evaluate, on a case-by-case basis, whether there is an imbalance of power between the data subject and the controller. The factors to be assessed include the position of the large online platform in the market, the existence of lock-in or network effects, the extent to which the data subject relies on the service and the main audience of the service.
The element of conditionality, i.e. whether consent is required to access goods or services, even though the processing is not necessary for the fulfilment of the contract, is another criterion to evaluate whether consent is 'freely given'. The CJEU has stated in the Bundeskartellamt judgment that users who refuse to give consent to particular processing operations are to be offered, ‘if necessary for an appropriate fee, an equivalent alternative not accompanied by such processing operations’. In doing so, controllers will avoid an issue of conditionality. In any case, the other criteria for ‘freely given’ consent still need to be fulfilled as well.
An ‘equivalent alternative’ refers to an alternative version of the service offered by the same controller that does not involve consenting to the processing of personal data for behavioural advertising purposes. The Opinion provides elements that can help ensuring the alternative is genuinely equivalent. If the alternative version is different only to the extent necessary as a consequence of the controller not being able to process personal data for behavioural advertising purposes, it can be in principle regarded as equivalent.
In respect of the imposition of a fee to access the 'equivalent alternative' version of the service, the EDPB recalls that personal data cannot be considered as a tradeable commodity, and controllers should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy. Controllers should assess, on a case-by-case basis, both whether a fee is appropriate at all and what amount is appropriate in the given circumstances, taking into account possible alternatives to behavioural advertising that entail the processing of less personal data as well as the data subjects' position. Controllers should ensure that the fee is not such as to inhibit data subjects from making a genuine choice in light of the requirements of valid consent and of the principles under Article 5 GDPR, in particular fairness. The accountability principle is key in this regard. Supervisory authorities are tasked with enforcing the application of the GDPR, which may also relate to the impact of any fee on the data subjects' freedom of choice.
Another condition is granularity: when presented with a ‘consent or pay’ model, the data subject should be free to choose which purpose of processing they accept, rather than being confronted with one consent request bundling several purposes.
Valid consent also needs to be ‘specific’, i.e. given for one or more specific purposes, and amount to an unambiguous indication of wishes: in ‘consent or pay’ models it is especially important for controllers to attentively design how data subjects are asked to provide their consent. Users should not be subject to deceptive design patterns.
For consent to be ‘informed’, the information process built by controllers should enable data subjects to have a full and clear comprehension of the value, the scope and the consequences of their possible choices, taking into account the complexity of processing activities related to behavioural advertising.
The EDPB also provides clarifications on the withdrawal of consent and advises controllers to carefully assess how often consent should be 'refreshed'.
Bron: European Data Protection Board
