Following a request by the Dutch, Norwegian, and German (Hamburg) supervisory authorities, the European Data Protection Board  (EDPB) adopted during its latest plenary Opinion 08/2024. The Opinion addressed the validity of consent to process personal data for  the purposes of behavioural advertising in the context of “consent or pay” models deployed by large online platforms, such as Amazon, Apple, META and Microsoft.

The Opinion aligned with the CJEU’s recent landmark judgment in META vs Bundeskartellamt Case C-252/21, which allowed GDPR scrutiny through antitrust regulators and imposed strict limitations on the personalized use of consumers’ personal data by social media platforms.

Addressing Consumer Rights and Impact

A significant challenge faced by businesses throughout the European Economic Area today is the evolving landscape of legal bases for data processing under the GDPR. User consent has long been a cornerstone for advertising technology firms, particularly in the context of deploying third-party cookies and user tracking.

However, under the GDPR, EU citizens are protected from imbalances of power concerning personal data processing, having the right to refuse to allow companies to process their personal data.

EDPB’s Guidance and Key Considerations

In Opinion 08/2024, EDPB underscored the necessity for personal data controllers to fully comply with all GDPR requirements, particularly those related to obtaining valid consent, while carefully assessing the unique circumstances of each case. The EDPB emphasized that large online platforms should not solely present users with a binary choice between consenting to behavioural advertising or paying a fee. Instead, these platforms must offer an “equivalent alternative” free of charge, such as a different form of advertising that does not rely on behavioural data.

Furthermore, if controllers opt to offer an “equivalent alternative” requiring a fee, they must also provide a further alternative free of charge and without behavioural advertising to ensure genuine choice. This consideration significantly impacts the assessment of
consent validity, particularly regarding potential detriment to data subjects.

The EDPB further highlighted that personal data should not be treated as a tradeable commodity, cautioning against transforming data protection into a premium feature.

Under EDPB Opinion 08/2024, controllers must carefully evaluate the appropriateness and amount of any fees imposed, ensuring they do not inhibit data subjects from making genuine choices.

Regarding the validity of consent, controllers must address several key criteria:

• Assessing whether data subjects face detriment for not consenting or withdrawing consent, particularly in cases where exclusion from services occurs.
• Evaluating power imbalances between data subjects and controllers, considering factors like market position and user reliance.
• Avoiding conditionality of consent for accessing goods or services unrelated to contractual performance, offering equivalent alternatives where necessary.
• Ensuring data subjects have granularity in choosing processing purposes and providing clear, informed, and unambiguous consent specific to each purpose.

Finally, the EDPB reiterated that obtaining consent does not exempt controllers from other GDPR principles, including purpose limitation, data minimization, fairness, data protection by design and default, and accountability. Controllers must integrate these principles into
their processing activities to ensure compliance with the GDPR and protect data subjects’ rights and freedoms effectively.

Assessing the Market Impact

The EDPB’s opinion on “consent or pay” models for behavioural advertising sets a significant precedent, as it stressed even more the need for controllers to prioritize user choice and data protection.

In the near future this guidance is bound to lead to more a transparent and user-centric approach in online advertising, ultimately empowering consumers and fostering fairer digital ecosystems.

In conclusion, by emphasizing genuine choice and data protection, the EDPB’s opinion heralds a new era of accountability in online advertising, putting user rights at the forefront of digital innovation. This approach further broadens the gap in personal data processing
mentality, compared to other global markets, highlighting the EU’s commitment to empowering consumers and upholding privacy standards.

For more information, please contact: