Is it acceptable to compel users to either pay a fee or provide consent for GDPR compliance?
The Legal Risks of 'Consent or Pay' Models for Publishers
In a recent development, the privacy advocacy group noyb has taken legal action against Meta, the parent company of social media giants Facebook and Instagram, over its controversial "Pay or Okay" model. This model presents European users with a choice: either consent to personalized advertising and data tracking or pay a substantial annual fee of up to €251.88 to safeguard their right to data protection. Beyond the concerns about the high cost, this model raises red flags regarding potential legal ramifications for publishers contemplating similar approaches.
Noyb's formal complaint, lodged with the Austrian data protection authority, spotlights the central issue of "freely given" consent as mandated by EU law. The European Court of Justice (CJEU) had previously deemed Meta's handling of user data for personalized ads illegal, resulting in a hefty €390 million fine in January. Now, Meta's introduction of a "privacy fee" for users opting out of targeted advertising is viewed as a direct contradiction to the principles of freely given consent.
Contrary to the essence of free choice, Meta's model imposes a financial penalty on users exercising their fundamental right to data protection. Felix Mikolasch, a data protection lawyer at noyb, emphasizes that such a "privacy fee" runs counter to EU law, which stipulates that consent must genuinely reflect the free will of the user.
While Meta justifies the "privacy fee" by aligning it with the preferences of a small percentage of users desiring personalized ads, industry data suggests that only 3 percent willingly choose to be tracked. In contrast, approximately 99 percent opt against payment when faced with the "privacy fee." This raises legitimate questions about the validity of consent in a system where financial constraints may coerce users into forfeiting their privacy rights.
Max Schrems, Chairman of noyb, critiques Meta's approach, asserting that systems like "Pay or Okay" undermine the concept of free consent. Drawing a parallel to swimming, he notes that when only 3 percent actively choose an option, but 99.9 percent end up with the same outcome, it indicates a lack of genuine free choice, which is both impractical and potentially illegal.
If Meta successfully defends its "Pay or Okay" model, it could establish a precedent for other companies to adopt similar approaches. Reports suggest that TikTok is already testing an ad-free subscription model outside the U.S. If more app providers follow suit, the cost of maintaining online privacy may become exorbitant. With an average of 35 apps installed on their smartphones, individuals could face a substantial "fundamental rights fee" of €8,815.80 annually, while a family of four might incur costs exceeding €35,000 per year.
Max Schrems poses a crucial question about the accessibility of fundamental rights, highlighting that historically, these rights were often reserved for the affluent. Meta's model, he argues, may perpetuate this trend by potentially excluding a significant portion of the population due to financial constraints.
One significant flaw in Meta's "Pay or Okay" model is its disregard for varying income levels across EU countries. With 21.6% of the EU population at risk of poverty or social exclusion, imposing a substantial fee for privacy protection can be perceived as discriminatory. Noyb points to a specific case where a complainant, facing financial distress and receiving unemployment assistance, cannot afford the additional €250 annual fee while struggling to meet basic living expenses.
Max Schrems emphasizes that for many individuals, a "Pay or Okay" system becomes a choice between essential needs like paying rent or maintaining privacy. This further highlights the potential socio-economic divide that such models may perpetuate.
The introduction of "Pay or Okay" models by tech giants like Meta raises substantial legal and ethical concerns. It challenges the core principles of freely given consent under EU law and may disproportionately impact users based on their financial capacity. As publishers contemplate similar consent or pay options, it becomes imperative to weigh the potential legal risks and ethical implications. Ensuring that user privacy remains a fundamental right accessible to all, regardless of financial status, should be a paramount consideration in the evolving landscape of data protection.