In November 2023, Meta Platforms Inc. updated its Privacy Policy in relation to behavioural advertising in the European Economic Area (EEA). Users of Facebook and Instagram in the EEA are hereinafter asked to choose between consenting on the processing of their personal data for behavioural advertising purposes or paying a fee for using the platforms without advertisements.
A. What is behavioural advertising and why is it crucial for Meta’s business?
Under the European Union’s General Data Protection Regulation (GDPR), digital platforms shall process users’ personal data for behavioural advertising on one of the legal bases of Article 6 par. 1. In case digital platforms choose the legal basis of consent, they shall ensure that consent is considered “valid” under the GDPR for users’ data to be legally used.
Behavioural advertising involves observing individual behaviour and is defined as “advertising that is based on the observation of the behaviour of individuals over time” while it “seeks to study the characteristics of this behaviour through their actions in order to develop a specific profile and thus provide data subjects with advertisements tailored to match their inferred interests” [1] (e.g. browsing habits, mouse clicks and app usage, then using that data to build profiles for targeting ads). This is often done through information collected from users’ activity on digital platforms as well as cookies stored on a user’s computer when using the platforms.
Behavioural advertising has been used by Meta offering tailored advertising on its platforms, based on users’ special preferences and needs. Behavioural advertising is crucial for Meta’s revenue because its function is based on an ads-supported digital business model as Meta primarily makes money by selling advertising space on its various social media platforms.
B. Meta’s unlawful behavioural advertising practices and EDPB’s ban
In the past, Meta has relied its behavioural advertising practices on the legal basis of contractual necessity (Article 6.1.b. GDPR) as well as on the legal basis of Article 6.1.f. GDPR according to which the data processing is necessary for the purposes of the legitimate interests pursued by Meta.
On 27 October 2023, the EDPB adopted an urgent binding decision instructing the Irish (IE) DPA as lead supervisory authority (LSA) to take, within two weeks, final measures regarding Meta Ireland Limited (Meta IE) and to impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire ΕΕΑ.
C. Meta’s counter-move? Launching a subscription service
Following the EDPB’s decision, Meta implemented a “consent or pay” mechanism to continue its operations in the EEA based on an ads-based business model. Meta offers subscribers an ad-free experience, while others can continue using the platforms with “tailored” ads – implying personalized targeting remains for non-subscribers.
In case users choose to consent on the processing of their personal data for behavioural advertising purposes, they are able to use Meta’s platforms free of charge as usual. In case they do not consent, they shall pay a fee to continue using Meta’s platform without advertisements. The fee imposed by Meta for the ad-free service, characterized by the company as “subscription”, starts from €9.99 ($10.59) per month and it depends on the number of user’s accounts as well as on whether the subscription is made through Meta’s websites or the Apple App / Google Play stores.
Therefore, users are provided with the following options:
“Pay or Ok” Options:
|
D. Legal concerns about this new Meta consent model?
Under GDPR, consent shall be freely given, consisting of an unambiguous indication of data subject’s wishes. However, a “traditional” consent mechanism, enabling users to continue using online platforms without consenting to the processing of their personal data, would not be, in general terms, compatible with the current business model of free online platforms. The option of a subscription for the use of Meta’ s platforms without advertisements could be considered a rational solution since behavioural advertising is Meta’ s source of revenue (as such, the use of Meta’s platforms without advertisements and free of charge, could negatively affect Meta’s current business).
However, several concerns have been raised regarding the compliance of Meta’s new consent model with the GDPR and in particular regarding the validity of consent.
- “Freely-given” consent?
When data subjects’ choice to not consent to the processing of their personal data is followed by the requirement to pay a fee, the “freely-given” nature of consent is questionable. In fact, data subjects may consent to the processing of their data in order to avoid paying a fee for using online platforms and not as a result of a genuine and free choice. Additionally, taking into consideration the imbalance of power between large online platforms and the average user, as well as the importance of such platforms in everyday social and professional life, the dilemma between consent and payment of a fee is problematic.
- Any limitation to the data collection?
Meta hasn’t provided detailed information on what data is collected and how it’s used, raising concerns about potential hidden tracking practices. Therefore, even in the paid ad-free version, the extent of data collection limitations remains unclear.
Furthermore, even if the “pay or consent” mechanism is considered lawful in principle, another issue affecting the validity of consent is whether such a fee is appropriate or excessive. The EDPB has emphasized that personal data cannot be considered as a tradeable commodity, and that the right to privacy shall apply to all circumstances regardless of the financial status of data subjects.
- Complaints
Several complaints have already been filed against the new consent mechanism of Meta, claiming it is unfair and illegal. On 29.02.2024, the European Consumer Organization (BEUC) filed its complaint against Meta’s “pay or consent” model, characterizing it as an unfair and misleading choice to consumers. Moreover, BEUC has raised concerns about the validity of the legal basis of consent and the compliance of META’s practices with the principles of fair processing, data minimization and purpose limitation of the GDPR. Also, the BEUC filed a joint complaint against Meta in December 2023, alleging that the subscription model also violates EU consumer laws claiming that Meta uses unfair, deceptive, and aggressive practices to pressure users into subscribing.
E. EDPB’s Opinion No. 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms
On 17.04.2024, the EDPB adopted its Opinion on valid consent in the context of “consent or pay” models implemented by Large Online Platforms, upon request of the Dutch, Norwegian and Hamburg Data Protection Authorities. According to EDPB, “in most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee”.
Moreover, the EDPB recommends online platforms to consider offering a further alternative, free of charge, without behavioural advertising, for example with a form of advertising involving the processing of less or even no personal data (“when developing the alternative to the version of the service with behavioural advertising, large online platforms should consider providing data subjects with an ‘equivalent alternative’ that does not entail the payment of a fee (e.g. including a different form of advertising that is not behavioural advertising)”).
As regards the assessment of the “freely-given” character of consent, it is emphasized that it is crucial to take into consideration the imbalance of power between the online platform and the data subject, as well as the prominent role of the online service in social life. The EDBD also highlights the importance of complying with all the requirements of the GDPR, including the requirements for valid consent and the general principles for data processing, therefore consent should:
- Be freely given (in this respect, large online platforms should consider, inter alia, whether the data subject suffers detriment as a consequence of not consenting or withdrawing consent, whether there is an imbalance of power between the data subject and them and whether any fee imposed is such as to inhibit data subjects from making a genuine choice or nudge them towards providing their consent).
- Be informed (data controllers have the responsibility, under the principle of accountability, of building up and documenting an information process enabling data subjects to have a full and clear comprehension of the value, the scope and the consequences of their possible choices).
- Be an unambiguous indication of wishes (large online platforms should attentively design the way in which data subjects are asked to provide their consent to ensure that data subjects are not subject to deceptive design patterns).
- Be specific (this means that large online platforms should precisely define and delimit the purposes of the processing activities for which consent is required).
F. Final remarks
The case of Meta and the legal discussion between Meta, European Data Protection Authorities and the EDPB is of general interest, since Meta’s business model is common among online platforms offering their services free of charge to the public. The EDPB, although it did not provide a specific answer on the Meta case, adopted an insightful opinion, recommending useful guidelines and alternatives to the existing “consent or pay” models to comply with the applicable legislation.
The protection of data subjects’ rights and privacy is fundamental in the European Union; thus, it shall not lead to excessive restrictions on the free movement of personal data and to specific business models. Meta’s case demonstrates the complexity of data protection and privacy legal issues, which also extend to other legal fields, such as consumer protection law. The role of the competent European Data Protection Authorities which will be called to decide on a case-by-case examination the lawfulness of “consent or pay” models is challenging, as they shall compromise the protection of data subjects’ rights in the European Union with the operation of online platforms with advertisement-driven business models.
[1] Article 29 Working Party Opinion 2/2010 on online behavioural advertising.
