EU Data Regulator Threatens Meta’s ‘Pay or Okay’ Model – Source: www.databreachtoday.com

General Data Protection Regulation (GDPR)
,
Governance & Risk Management
,
Privacy

The European Data Protection Board Says the Company Inhibits Real Choice for Users

Akshaya Asokan (asokan_akshaya) •
April 17, 2024    

Social media giant Meta’s attempt to navigate European data protection rules by offering a fee-based opt-out from behavioral advertising came under fire Wednesday by a trading bloc agency that said freedom from personalized marketing should typically be free.

See Also: The Ultimate PIA and DPIA Handbook for Privacy Professionals

The Facebook parent has come under mounting European pressure after it reacted in late 2023 to setbacks at the behest of European data protection authorities by rolling out an option for users to buy their way out of having their web activity tracked for advertising purposes – a model known as “pay or okay” (see: Pressure Mounts on Meta to Scrap ‘Pay or OK’ Model in EU).

The European Data Protection Board added to that pressure in a statement that says opt-outs to behavioral advertising “should not be the default way forward for controllers.” The board’s mandate under the General Data Protection Regulation is ensuring a consistent application of the sweeping privacy regulation across trading bloc members.

Instead, they should rely on an “equivalent alternative” that does not “entail the payment of a fee” and comes with limited processing of personal data.

“Meta is out of options in the EU,” said Austrian privacy activist Max Schrems, who in November filed a complaint alleging that consent to online tracking cannot be “freely given” under the GDPR if it comes at a literal high cost. He filed a follow-up complaint in January.

Schrems and other European activists say that behavioral advertising conducted without express consent intrudes on a fundamental right to privacy.

“Controllers should take care at all times to avoid transforming the fundamental right to data protection into a feature that individuals have to pay to enjoy. Individuals should be made fully aware of the value and the consequences of their choices,” said Anu Talus, the EDPB chair.

The regulator intends to develop guidance on “pay or okay” consent following industry consultation.

EDPB’s latest opinion comes after Norwegian, Dutch and Hamburg data protection authorities questioned the validity of the subscription opt-out model.

A Meta spokesperson did not immediately respond to a request for comment, although the company has earlier said the payment model “follows the guidance of the highest court in Europe” (see: Pressure Mounts on Meta to Scrap ‘Pay or OK’ Model in EU).