EDPB Opinion: Meta cannot rely on “Pay or Okay”

EDPB #Opinion: #Meta cannot rely on “Pay or Okay”

Vienna, April 17th, 2024

Today, the EDPB has issued its first decision on “Pay or Okay” in relation to large online platforms such as #Instagram and #Facebook, as first reported by Politico. This decision prohibits Meta to use an unlawful “legal basis” for processing personal data. It seems that by now, Meta seems to have run out of options to continue using people’s data for advertising in the EU without a consent mechanism that actually complies with the law.

• Politico report on the EDPB decision

• First noyb complaint against Meta’s “Pay or Okay” system

• Second noyb complaint against Meta over “Pay or Okay”

Opinion on large online platforms. As argued in cases brought by noyb before, the EDPB seems to follow the logical understanding of the words “freely given consent” when it analyzed Meta’s “pay or okay” system, that charged users more than 250 euros per year for Instagram and Facebook if they would not “freely” consent to the use of their personal data. Politico cites the EDPB saying “In most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioral advertising purposes and paying a fee”.

Max Schrems: “Overall, Meta is out of options in the EU. It must now give users a genuine yes/no option for personalised advertising. It can still charge pages for reach, engage in contextual ads and alike - but tracking people for ads need a clear ‘yes’ by users."

Discussion stated—evidence needed. Today’s EDPB opinion needs to be analysed in more detail once it is fully published. It is likely to be only a starting point for a wider discussion on “Pay or Okay” in various contexts, given that the EDPB intends to issue further guidelines later this year that go beyond “large online platforms”. The core question remains whether a “Pay or Okay” model can meet the legal requirement that consent must be “freely given” and that the “genuine wishes” of the users are upheld. After all, consenting to the processing of personal data is a decision to give up the fundamental right to data protection. Usually, fundamental rights cannot be “sold” or only granted for a fee. The EDPB has so far largely decided in a vacuum, without independent and comprehensive evidence of how a “Pay or Okay” model interferes with users’ genuine and free choice.

Max Schrems, Chairman of noyb: “We welcome that the EDPB has started a more nuanced discussion on ‘pay or okay’ and at least clarified that large platforms cannot use ‘pay or okay’. However, we fear that today’s first opinion is rather cautious and was based on limited facts. Once all facts are on the table we are confident that ’Pay or Okay’ is generally declared unlawful. We know that ‘Pay or Okay’ leads to a shift from about 3% to more than 99% in consent rates—so it is as far from ‘freely given’ consent as North Korea is from a #democracy. It is crucial to get all the relevant numbers for further decisions beyond Meta and larger platforms.”

Third option needed. The EDPB also mentioned the possibility of introducing a third option beyond “Pay or Okay", which has so far been largely ignored by the industry. In fact, there are many ways to monetise a website, such as contextual advertising, product placement, paid content or freemium models where certain content is only available for a fee. While the industry tries to limit the discussion to two options ("pay” or “okay"), the EDPB has emphasised that the GDPR does not limit other ways of funding products—even if they may be less profitable.

Pay or Okay is the end of “freely given” consent. As we have warned in recent months, “Pay or Okay” results in massive costs for consumers (easily €35.263,20 for a family of four), that far outweigh publishers’ current ad revenues which often amount to just a few cents. The current average revenue for programmatic advertisement in the EU is 1,41 euros per user—across all websites per month. In countries like Austria, Germany, France, Spain or Italy visiting the top 100 websites can already cost more than 1.500 euros per year if you do not consent to tracking. In last week’s background video we also highlighted the problematic decision making dynamics of “pay or okay", which changes the “free wish” of users from 3 percent who want to have personalised advertising to up to 99.9 percent who (unwillingly) click “agree” if the alternative is a hefty bill.

Max Schrems: “When more than 90 percent of users agree to something they don’t want, you don’t need a lawyer to see that it’s not ‘freely given’ consent. In fact, 5 years after the GDPR came into force, this is just the latest ’trick’ to undermine EU law or at least delay compliance for a few more years. It is highly problematic that authorities have not already taken a clear position on this. In the cases we have brought in Austria or Germany, we rather see that the authorities turn a blind eye to ‘Pay or Okay’ because it was first introduced by news media, which they do not want to interfere with - even though the law is the same for everyone.”

Background

Until the #GDPR became applicable on 25 May 2018, Meta has used “consent” under Article 6 (1) (a) GDPR as the legal basis for processing users’ personal data, for example for advertising. Under the GDPR, consent would have to be specific, informed, unambiguous and freely given. Meta feared, that giving users such a yes/no option would limit their options to make money in the EU, so at midnight on 25 May 2018, Meta started arguing that it was part of the user contract to show ads, using Article 6 (1) (b) GDPR. This was ruled illegal by the Court of Justice of the European Union (CJEU) and the European Data Protection Board (EDPB) in 2023. In 2023, Meta then briefly argued that it had a “legitimate interest” to process personal data for advertising under Article 6(1)(f) GDPR, until it began to revert to “consent” under Article 6(1)(a) GDPR—by asking users to consent or pay a fee of up to € 20.99 for Instagram and Facebook combined. 

The Norwegian data protection authority took “Pay or Okay” back to the EDPB, which has now issued a decision. All these attempts to circumvent the law have been done with the active support of the Irish Data Protection Commission (DPC), as the lead regulator of Meta’s EU headquarters in Ireland. All of these “agreements” with the Irish regulator were later found to be unlawful by the EDPB or the CJEU.