Is Pay or Consent a choice under GDPR?

Recent European data protection decisions have reshaped the advertising landscape, prompting strategic choices between advertising and payment. Such alternative is now challenged by the freedom of consent requirement under GDPR. The ‘pay or OK’ debate requires a consistent articulation between consumer protection (contract law and fairness), competition (pricing) and privacy protection (individuals rights) rules. Since 2020, no EU DPA that has adopted a position on ‘paywalls’ has issued any general prohibition. Instead, they have established a list of criteria feeding case-by-case analysis. In July 2023, the ECJ pushed back a mere ban of ‘pay or OK’ models. Now, the much expected EDPB opinion to be issued this spring regarding the paywall proposed by Meta will be key. The threat of an outright ban on subscription-based models would jeopardize digital press and media who depend on personalized advertising revenues. All in all, same consent rules should apply to all service providers.

Executive summary

Advertising has long been the backbone of the media industry's economy, but the role of advertising in a world filled with information and services is being questioned. Recent European data protection decisions have reshaped the advertising landscape, raising questions about the balance between advertising and fundamental freedoms such as data protection, freedom of expression, assembly, and the right to conduct business.

Companies funded by advertising are increasingly turning to subscription-based models, such as 'paywalls', to compensate for users who refuse consent for personal data collection for personalized advertising. In essence, subscription-based models are a means for digital businesses to sustain themselves and continue offering their services in a financially viable manner. 

Digital press, media, and content publishers rely heavily on advertising for revenue. They have various costs to cover, including content, employee salaries, licenses, data hosting, infrastructure, and more. Without advertising and paywall options, these digital businesses would struggle financially, as contextualized or non-personalized advertising generates significantly lower revenue.

Running any business incurs costs, and the criticism of Meta's subscription-based model often revolves around the misconception that users are selling their privacy. In reality, paywalls provide a price for the service itself, not for user’s privacy. Notably, privacy isn't 'bought' in this model; users decide between (1) payment and access to the service that is compliant with data protection regulations, or (2) free access to the service that is still compliant with data protection regulations.

The idea that digital services should be free is unrealistic. No private business, regardless of its size, is required to provide its services for free. Even essential services like water, oil, gas, or electricity are provided for a fee because they involve resources that must be purchased and resold.

The rise of paywall alternatives in the digital landscape raises questions about user’s consent and freedom of choice. An analysis of these alternatives and their impact on user’s freedom of choice is crucial. In the subscription-based model, users have options. They can choose to pay for a service or consent to personalized advertising / advertising cookies for free access while still benefiting from all their data protection rights. 

Consent plays a pivotal role in targeted advertising, given limitations of the use of other legal grounds. Users must have transparent choices and a clear understanding of terms of such consent and its alternative. While digital service providers typically determine prices, the validity of the “GDPR” consent of users is not linked to their ability to control pricing. What matters most is that users are fully informed about available options and the consequences of their choices, emphasizing transparency. To enhance user’s freedom in the digital realm, it is essential to focus on improving user’s comprehension of both personalized advertising consent and a paid subscription option, potentially through regulations ensuring clear, concise, and understandable presentation of terms, aligning with GDPR principles.

In the EU, the legality of subscription-based models remains uncertain and no clear regulation dealing with both data protection principles including the validity of user’s consent as defined by GDPR, and online services offerings, labels paywalls as universally lawful or unlawful.

Following a legal challenge by industry associations especially press and media publishers, including GESTE[1], the Conseil d'État (French highest administrative court) ruled on June 19, 2020, that the CNIL couldn't impose a blanket ban on cookie walls. The court emphasized that obtaining free consent for data processing should be evaluated individually, in consideration of diverse situations and contexts.

As a result, the CNIL revised its cookies guidelines in September 2020, admitting that the validity of cookie walls or paywalls with regard to the freedom of consent requirement should be assessed on a case-by-case basis, combining the following criteria:

• Offering a fair alternative to cookies acceptance;
• Providing an equivalent service by the same provider;
• Setting a reasonable price for alternatives;
• Limiting cookie purposes in paywalls to justified ones.

The Danish, German, Italian, Spanish, UK DPAs have also acknowledged the potential legality of cookie walls, under similar conditions. Although not all European countries have expressed the same position, the current regulatory trend among the authorities that have issued comprehensive guidance on cookie walls / paywalls emphasizes a user-centric approach.

Instead of an outright ban on subscription-based models, such authorities are advocating for a careful, case-by-case analysis to ensure that users are aware of their choices and can make them freely and with informed consent. These are exact same criteria as those required under consumer protection laws, in particular regarding fair commercial practices. European privacy regulators should acknowledge the legitimacy of paywalls and advertising alternatives under applicable laws and provide concise guidelines paving the way for case-by-case decisions to harmonize the criteria ensuring the protection of user’s privacy in subscription-based models, such as paywalls. A common regulatory approach would foster an environment where user’s privacy and sustainable press and media economy coexist.

Unified EU guidance on paywalls resulting from close collaboration between data protection authorities (that would analyze the matter under privacy regulations) and competition/consumer authorities (that may intervene on pricing and marketing fairness subjects), would be necessary in order to stabilize the applicable framework ensuring the consistent regulation of business models vs. privacy considerations.

The debates that are taking place within the 1^st semester of 2024 within the EDPB regarding the paywall proposed by Meta will be key, as the threat of an outright ban on subscription-based models would jeopardize the future of the press and media in Europe, notwithstanding the necessary balance between consumer protection, competition and privacy protection rules. Indeed, the legal compliance of the subscription-based model also relies on pricing issues (competition law), transparency (consumer rights), and conditions to access and fund a service (contract law).

Download the full publication below.

Authored by Etienne Drouard, Olga Kurochkina, and Rémy Schlich.