Written by: Haim Ravia and Dotan Hammer
The European Data Protection Board (EDPB) has issued a comprehensive opinion addressing the challenges of “consent or pay” models used by large online platforms. The opinion explains that valid consent is often unattainable when users are only given a binary choice between consenting to data processing for behavioral advertising or paying a fee to access the service. According to the opinion, this arrangement provides neither genuine choice nor the freedom required for valid consent under the GDPR.
The EDPB’s opinion effectively advises against defaulting to paid alternatives for services involving behavioral advertising. Instead, platforms should offer equitable alternatives that do not require payment and are less privacy-invasive, thus upholding the non-marketable nature of personal data and the fundamental right to data protection.
The opinion also outlines the following aspects:
- Controllers must adhere to all GDPR principles even when consent is obtained.
- Respecting limits on data collection, purpose limitation, and data minimization.
- Processing should align with data subjects’ expectations and avoid unfair discrimination or exploitation.
- Transparency to data subjects is key, so they can understand how their data is processed and the implications of their consent decisions.
- Children, in particular, should be protected from behavioral advertising and “consent or pay” models.
- In cases of clear power imbalance, consent may not be a valid legal ground for processing at all, unless there are no adverse consequences for the data subject.
- Consent can only be considered valid for a limited period, depending on the intrusiveness of the processing activities.
Click here to read the EDPB’s opinion on the challenges of “consent or pay” models used by large online platforms.
