The end of ‘Pay or OK’?

The end of ‘Pay or OK’?

The rise of the ‘Pay or OK’ concept

This ‘Pay or OK’ phenomenon began in January 2023 when the European Data Protection Board (EDPB) fined Meta 390 million euros, arguing that they did not have an adequate legal basis for personalized advertising to their users, which they later justified on legitimate interest grounds. However, the Court of Justice of the European Union (CJEU) ruled on this matter in July 2023, declaring Meta’s processing of personal data illegal. Consequently, months later, the EDPB finally prohibited Meta from processing personal data of its EEA users for behavioral advertising when based on the contract with their users and legitimate interest.

In fact, the Spanish Data Protection Agency (AEPD) took these new EDPB guidelines into consideration and published a new Guide on the Use of Cookies, which established new obligations for all website operators that had to be implemented and complied with by January 11, 2024.

Among the various guidelines established on the use of cookies, it introduced the obligation to include the option to reject cookies in the first layer of information (or cookie banner) on all websites.

This obligation to offer users the option to reject cookies led Meta to seek an alternative in response to the decline in advertising revenue they were experiencing. They implemented what is known as ‘Pay or OK’ or ‘cookie paywalls’, meaning users are offered the choice to pay a fee to continue browsing the website or platform without having advertising cookies installed and tracking the device if they do not consent to the installation of such cookies.

This ‘Pay or OK’ phenomenon promoted by Meta has been copied in recent months by numerous platforms and websites that have started offering users the option to pay subscriptions to access their content without the use of these advertising cookies.

Analysis of the ‘Pay or OK’ regulation

Following the proliferation of the ‘Pay or OK’ phenomenon, numerous NGOs have criticized its use, arguing that the consent given by users for the installation of cookies and the processing of the obtained data is not based on free consent but is rather conditioned.

Last April, the European Data Protection Board (EDPB) addressed this issue in Opinion 08/2024 on the ‘consent or payment’ models of major online platforms. This opinion was developed considering the GDPR, the ePrivacy Directive, and recent regulations on digital services (DSA) and digital markets (DMA).

The opinion was adopted following a request from the Dutch, Norwegian, and Hamburg data protection authorities. It addresses the validity of consent for processing personal data for behavioral advertising in the context of the ‘consent or payment’ models deployed by major platforms.

Specifically, the EDPB established that the use of these ‘Pay or OK’ models does not meet the requirements for obtaining valid user consent, as they only offer users the choice between giving consent for the processing of personal data for behavioral advertising or paying a fee. However, these platforms must offer a third free alternative that does not involve paying a fee to avoid the processing of their personal data for behavioral advertising purposes.

Alternatives for companies and users

In conclusion, companies must consider providing users with an equivalent alternative that does not involve paying a fee or charge. If they choose to charge a fee for access to the equivalent alternative, they should consider offering an additional alternative.

This additional alternative should be a free option that does not involve behavioral advertising, such as offering advertising that involves minimal or no personal data processing, thereby complying with the requirements for obtaining valid user consent.

Obtaining user consent for behavioral advertising purposes only by offering the payment of a fee as an alternative does not comply with the principles of Article 5 of the GDPR, and, consequently, the consent obtained for such processing is not GDPR-compliant.

Therefore, platforms must consider criteria such as dependence, detriment, imbalance, and granularity to ensure that user consent is given freely and validly, in accordance with the GDPR.

For users, the adoption of a valid and legal alternative by major platforms for users to consent to the use of their data will mean they do not have to give away their data or pay to withhold it. Currently, users are consenting to the processing of their data to use a service or access web content without understanding the legal implications of this choice.

Finally, it is important to highlight that the AEPD has updated the Guide on the Use of Cookies to include these new guidelines from the EDPB, emphasizing the importance of these platforms complying with the principle of data minimization, which obliges data controllers to ensure that only data strictly necessary for advertising activity is processed.

Although the opinion published by the EDPB refers only to major platforms, the EDPB has communicated that it is working on a future second position applicable to all consent or payment models, not just those implemented by major online platforms. They will collaborate with these platforms to develop new guidelines on ‘consent or payment’ models with a broader scope, expected to be published in the first half of 2025.