Does privacy have a price?
It might seem like a redundant question, and the answer NO as obvious, but it turns out it is not that simple. How did we even get to this question?
Meta’s Attempts to “Bypass” GDPR
All those who use Meta’s platforms like Facebook and Instagram might have noticed that Meta uses user data for behavioral (targeted) advertising based on observation of individuals’ behavior through their online activities (website visits, online content searches, interactions with platforms and other users, likes and other clicks, etc.).
However, is that allowed? Since the application of GDPR in May 2018, Meta has been trying to “find” an appropriate legal basis for processing user’ data for the purpose of behavioral advertising. Initially, Meta claimed that tracking user behavior and online advertising are part of the “service” and as such necessary for the performance of the contract that users entered into with Meta by accepting the Terms of Service. After the European Data Protection Board (EDPB) decided in December 2022 that a contract cannot be an adequate legal basis for behavioral advertising, Meta decided to rely on legitimate interest. However, the European Court of Justice ruled in July 2023 in case C-252/21 that Meta cannot use legitimate interest for behavioral advertising.
Instead of simply aligning its operations and seeking user consent for behavioral advertising in accordance with the GDPR after failed attempts, Meta came up with a new solution – the “Pay or Okay” model, also known as the “consent or pay” model.
What is “Pay or Okay” model?
Shortly, if users do not want their data to be used for behavioral advertising, they do not have to give consent, but they must pay a certain annual amount to use the service. Other organizations and companies in European Union countries soon began to follow this model.
Although there is an unequivocal stance from the authorities that, for example, consent given through pre-ticked boxes is not lawful, paying for data has created confusion among the national data protection authorities. Therefore, data protection authorities of Norway, the Netherlands, and Germany requested an opinion from the EDPB on whether such consent is in line with the GDPR.
What is the EDPB’s position?
After a full three months, the EDPB adopted the long-awaited opinion on April 17, 2024. The opinion is limited to implementation of the “Pay or Okay” model only by major online platforms and exclusively for the purpose of behavioral advertising.
In its opinion, the EDPB concluded that in most cases, it will not be possible (not that it is impossible) for major online platforms to meet the requirement for obtaining valid consent if users have only the choice to either provide data for advertising purposes or to pay a fee since data subjects does not have a real and genuine freedom of choice when asked to consent to the processing of their personal data.
In this regard, the EDPB emphasizes that major online platforms should consider a third free, equivalent alternative to their service that does not involve behavioral advertising.
Therefore, major online platforms should assess, on a case-by-case basis, whether the fee is appropriate at all and what amount is appropriate in the given circumstances, taking into account the requirements for valid consent under the GDPR, as well as the need to prevent the fundamental right to data protection from being transformed into something individuals would have to pay for to enjoy, or into a privilege reserved only for the rich and wealthy.
What is the conclusion in the end?
From a legal perspective, the opinion of the EDPB does not provide legal certainty and does not answer the question. Rather, it raises some new ones – Under what conditions would it be possible to apply the “Pay or Okay” model? What would be an adequate alternative? Can other organizations that are not major online platforms or for some other purpose still request payment for our data? What would then be an appropriate price for privacy?
How the competent authorities in the European Union will implement this opinion, what Meta and other online platforms will come up with next, and how all of this will affect the personal data of individuals from the territory of the Republic of Serbia, remains yet to be seen.
