Ad bodies challenge ‘consent or pay’ restrictions as UK guidance issued

The bodies issued the call to the European Data Protection Board (EDPB), which is in the process of developing new guidance on consent or pay models, and before the UK’s Information Commissioner’s Office (ICO) issued new guidance of its own on the issue.

Under ‘consent or pay’ models, businesses make individuals choose between paying to access services they offer or allowing their personal data to be processed in return for gaining access to those services for free.

Last year, the European Data Protection Board (EDPB) said large online platforms presenting users with only that binary choice will, “in most cases”, be non-compliant with the General Data Protection Regulation (GDPR).

At that stage, the EDPB said: “Personal data cannot be considered as a tradeable commodity, and large online platforms should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy. Therefore, the offering of (only) a paid alternative to the service which includes processing for behavioural advertising purposes should not be the default way forward for controllers.”

“On the contrary, when developing the alternative to the version of the service with behavioural advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee (e.g. including a different form of advertising that is not behavioural advertising),” it said.

The EDPB is in the process of developing further guidance on consent or pay models that will be applicable to all other organisations. It invited companies to attend an event in November, to give them an opportunity to relay their views on the economic and practical implications of further restrictions on such models, ahead of finalising the new guidance.

Together with some national ad industry bodies, IAB Europe has now issued a feedback paper on the event in which it not only argued that consent or pay (CorP) models adhere to the requirements of the GDPR – including its rules around consent-based processing of personal data – but also warned that a strict interpretation of those consent rules by data protection authorities would harm consumers.

Consent is one of six lawful bases for processing personal data under the GDPR. To be valid, consent must, in general, be freely given, specific and informed, and also be an unambiguous indication of the data subject's wishes stipulated by a statement or by a clear affirmative action. Explicit consent is required in instances where businesses intend to process special categories of personal data, such as health data.

In a statement issued alongside their paper, the ad bodies said: “CorP models inherently provide users with autonomy by offering clear options for accessing an online service involving paying a fee or accepting the processing of personal data for personalised advertising purposes to have free access. Users also retain full freedom to choose neither option and seek alternative services instead. Additionally, there is no obligation for businesses to provide their services for free, nor is there any obligation for businesses to provide their services at a loss which would inevitably be the case should a third, free alternative without personalised advertising be required where CorP models are used.”

“Personalised advertising is a significant revenue driver for many online services, with contextual advertising falling short as a viable alternative. Studies indicate that contextual ads generate significantly less revenue and are less effective in filling available ad slots. It will therefore no longer be feasible for many businesses to maintain a free (or lower-priced) access option funded by advertising due to much lower revenues should such an alternative be required – which would ultimately be to the detriment of users,” they said, adding that severe restrictions on consent or pay models could also run contrary to the freedom to conduct a business provided for in the EU’s Charter of Fundamental Rights.

In its new consent or pay guidance, the UK ICO said the extent to which online service providers can adopt consent or pay models will depend on whether the services available under the two options – the consent model and the pay model – are “broadly equivalent”.

“Equivalence between the product or service offered under each of the ‘consent’ and ‘pay’ options is necessary to ensure that people have a genuine free choice about consenting to personalised advertising,” the ICO said.

“Offering a ‘pay’ option, which allows people to access the service without giving their consent to personalised advertising, can remove this conditionality and create a genuine free choice for people. However, this is only a genuine and free choice if the services offered under the ‘consent’ and ‘pay’ options are broadly equivalent,” it added.

“If you cannot meet our expectations of equivalence, you must be able to demonstrate that people can still freely give their consent, taking all the other factors into account. If you are unable to demonstrate that you offer an equivalent service across your “consent” and “pay” options, you should reconsider what you are offering to ensure you provide an equivalent service. In some cases, to provide valid consent an organisation may need to offer an additional option. This option would need to allow people to access an equivalent core product or service without requiring consent for personalised advertising or paying to avoid personalised advertising,” the ICO said.