Nearly 5 billion people use social media. That’s billions of data subjects, with personal data ready to be tracked and processed for direct marketing. 

This information, however, can only be handled if the data subject agrees to their cookie policy. Under the Privacy and Electronic Communications Regulations (PECR), consent must be freely given with full awareness of what data will be collected. 

But things are changing. The privacy model ‘consent or pay’ is rising on online platforms, leaving data subjects with two options: pay for freedom or pay with personal data. 

What Is the Consent or Pay Model?

The ‘consent or pay’ model (or ‘pay or okay’ model) involves data controllers providing individuals with a choice to access their online service (e.g., a social media platform). 

The data subject can either:

1. Consent to getting their personal data processed for a specific purpose; or,
2. Pay a fee to use the online service without processing their data. 

Meta, the social media giant, uses this ‘pay or okay’ model across its platforms (since 2023). Users who agree to option one consent to being tracked and targeted with behavioural advertising. 

Fee payers access a paid version of Meta’s platforms without behavioural advertising. However, tracking, such as functionality cookies, may still be included. 

What Is Behavioural Advertising?

Behavioural advertising is the ongoing monitoring of a data subject’s online behaviours and actions. This may include site visits, interactions or topic interests. The data controller uses these insights to form a precise user profile that determines what advertisements are shown to them. 

Behavioural advertising is more sophisticated than ever and is critical to the success of many organisations’ digital marketing efforts. 

What Does the UK GDPR Say About Pay or OK? 

In the UK, the ICO has taken a neutral approach to determining whether the ‘consent or pay’ model is fair. So far, the Regulator has asked for feedback to support its initial view, which closed on 17th April 2024. 

As of yet, the UK GDPR doesn’t prohibit this model, but factors must be considered to ensure that consent and the right to withdraw are freely given should a user have their data processed. 

The ICO’s Approach for Adopting this Model

As speculation rises, the ICO has developed a non-exhaustive list of areas to consider when adopting this model:

1. Power Balance

Consent for targeted advertising can not be freely given if data subjects have minimal choice about whether to use a service or not. For example, if a user needs to access a public service or platform with a ‘position of market power’. 

2. Equivalence 

How different is the paid-for service from the free version? If a service provider includes add-ons to the paid service, this would affect how freely the user can consent. 

3. Appropriate Fee 

What is the fair price for privacy? Unreasonably high fees limit who can be free from advertising and who can’t. This power imbalance must be carefully considered to ensure the set fee is realistic. 

4. Privacy by Design

The options provided in a ‘consent or pay’ model should be clear and outline what each involves. Every data subject has the right to be informed, so consent cannot be freely given if individuals don’t understand how their data will be used. 

Withdrawing consent should also be as simple as giving it. The right to withdraw is a legal right, so organisations must act on people’s wishes when communicating with them. 

The EDPB’s Take

The European Data Protection Board (EDPB), the EU’s data protection authority, has taken a more explicit stance, providing their opinion on ‘pay or okay’ business models (17th April 2024). 

The main takeaway from this 42-page document is straightforward: give the user a real choice. The EDPB recommends that Meta and other platforms offer EU citizens three options, not two.  

1. Paid subscription – Pay for platform access with zero behavioural advertising.
2. Free account – Free-to-use account with behavioural advertising.
3. Free account without advertising – Use the platform for free where certain advertising without data processing is allowed. 

Our Opinion

Can we truly put a price on privacy? In a recent podcast, our data protection experts shared their insights on the controversies surrounding the ‘pay or okay’ model. 

There is a growing worry that it could create a power imbalance, where those must pay to enjoy greater privacy. What are your thoughts? Listen to our next Data Protection Made Easy podcast to voice your opinion.

Looking for a GDPR Expert? 

Data Protection People is a leading GDPR consultancy that helps organisations across the UK. 

From specialist data protection officers (DPOs) to GDPR audits, we can help you maintain compliance and keep your customer’s data safe. Contact our team today.