EDPB'S Opinion On Consent Or Pay Models: Key Takeaways

ELVINGER HOSS PRUSSEN, société anonyme


Independent in structure and spirit, Elvinger Hoss Prussen guides clients on their most critical Luxembourg legal matters. Committed to excellence and creativity in legal practice, our firm delivers the best possible advice for businesses, institutions and entrepreneurs, playing a unique role in the development of Luxembourg as a financial centre.
On 17 April 2024, the European Data Protection Board (the "EDPB") adopted its Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms...
Luxembourg Privacy
To print this article, all you need is to be registered or login on Mondaq.com.

What happened?

On 17 April 2024, the European Data Protection Board (the "EDPB") adopted its Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms (the "Opinion"). The Opinion addresses the circumstances and conditions under which "consent or pay" models for behavioural advertising can meet the criteria for valid, and particularly freely given, consent.

In the context of behavioural advertising, "consent or pay" refers to business models where a controller offers data subjects a choice between accessing an online service for free by consenting to processing of personal data for behavioural advertising purposes and paying a fee if they refuse that personal data is being processed for these purposes.

Key takeaways of the Opinion

After recalling the definition of consent under the General Data Protection Regulation (the "GDPR")1, the EDPB concludes that, in most cases, large online platforms fail to meet the requirements for valid consent when presenting users with the above-mentioned binary choice.

The EDPB built on its previous guidelines on consent2, highlighting the fact that assessing "freely given consent" involves considering factors like detriment when consenting, power imbalances, conditionality and granularity. The EDPB considers that in "consent or pay" models:

  • Potential detriment includes financial consequences, disruption of daily life if not having access to a social media or hindrance to career opportunities if access to professional platforms is denied.
  • Power imbalances should be evaluated, notably according to factors such as the platform's market dominance, the availability of alternative services, the essential nature of the service and the target audience, and addressed by offering equivalent alternatives.
  • To prevent issues of conditionality, data subjects should not be required to consent to processing activities beyond what is objectively necessary for the performance of the contract. Otherwise, they should be offered an "equivalent alternative."
  • Granularity of consent, which is the ability to separate consent for different personal data processing operations, may be compromised in complex digital ecosystems like behavioural advertising.

Consequently, the EDPB advocates for offering a third option in the form of a free alternative without behavioural advertising. Otherwise, if the controller deems that a fee is necessary, it should be of an appropriate amount low enough to ensure freely given consent. Such alternative version could employ less intrusive forms of advertising, such as general advertising.

Building on the judgment of the CJEU in Bundeskartellamt3, the EDPB clarifies the notion of "equivalent alternative" and explored whether, in cases where the fee for the behavioural advertising-free option is appropriate (i.e. sufficiently low), users can still be deemed to have freely consented when opting for the free version containing behavioural advertising.

  • Equivalent alternative: the EDPB stresses that two online services can be deemed equivalent if they are provided by the same controller and offer the same elements and functions. However, they do not need to be identical if differences are justified due to the controller's inability to process personal data for behavioural advertising purposes.
  • Appropriate fee: the EDPB recalls that personal data cannot be considered as a tradeable commodity. Ultimately, it is the controllers' responsibility to assess whether the fee for their paid version still allows data subject to give valid consent to the processing of their personal data for utilizing the free version. However, the EDPB also reminds that supervisory authorities are competent to review such assessment.

All other criteria for valid consent under the GDPR remain applicable: informed and specific consent and unambiguous indication of wishes.

What's next?

Large online platforms "should assess, on a case-by-case basis, both whether a fee is appropriate at all and what amount is appropriate in the given circumstances, bearing in mind the requirements of valid consent under the GDPR as well as the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy, or a premium feature reserved for the wealthy or the well-off".


1. According to article 4(11) of the GDPR, consent of the data subject means "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".In the Opinion, the EDPB specifically focuses on each of these criteria, placing particular emphasis on the requirement for freely given consent.

2. See EDPB, Guidelines 05/2020 on consent.

3. Judgement of 4 July 2023, Meta Platforms Inc. v Bundeskartellamt, C-252/21, EU:C:2023:537.

The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.

See More Popular Content From

Mondaq uses cookies on this website. By using our website you agree to our use of cookies as set out in our Privacy Policy.

Learn More