Nearly two dozen civil society organizations and non-profits have issued an open letter to the European Data Protection Board (EDPB) asking it not to accept Meta’s plan to circumvent EU privacy rules for commercial advantage.
The letter comes before an EDPB meeting this week that is anticipated to provide advice on Meta’s contentious monitoring strategy that demands Facebook and Instagram users to agree.
In February, EDRi, Access Now, Noyb, and Wikimedia Europe signed an identical open letter to the EDPB. However, the Board is anticipated to adopt an opinion on “consent or pay” (A.K.A. “pay or okay”) as soon as Wednesday, so rights organizations may have one final opportunity to change public opinion on an issue they deem “pivotal” for European data protection and privacy.
The open letter urges you to avoid endorsing a strategy that circumvents EU data protection regulations for commercial gain and instead advocate for robust protections that prioritize data subjects’ agency and control over their information as you shape guidelines on the ‘Consent or Pay’ model. Embracing true choice and meaningful consent conforms with data protection law, the relevant CJEU judgments, and the basic rights of persons within the EEA [European Economic Area],” it said.
Meta spokesperson Matthew Pollard confirmed in an email that their “Subscription for No ads” is EU-compliant: ‘Subscription for No Ads’ covers current regulatory developments, guidelines, and decisions from prominent European regulators and courts. It follows the CJEU’s July ruling that the subscriptions model may be used to consent to data processing for personalized advertising.
Meta’s pay-or-consent strategy has drawn several objections since it announced the “no ads” membership option last autumn. Last month, the EU launched a formal inquiry into Meta’s strategy to see whether it violates Facebook and Instagram’s Digital Markets Act responsibilities. That investigation continues.
Meta was also asked by the EU about “consent or pay,” using its oversight powers to monitor bigger platforms’ compliance with the Digital Services Act (DSA), a sister statute to the DMA that applies to Meta’s social networks, Facebook and Instagram.
The Board’s position on “consent or pay” should clarify how the EU’s General Data Protection Regulation (GDPR) should be enforced. The new market contestability regulation expands on the bloc’s data protection framework, referring to GDPR notions like permission and making it applicable to the DMA.
This means guidance from the EDPB, a GDPR-focused steering body, on how or whether “consent or pay” models can comply with EU data protection rules may affect whether the Commission finds Meta’s DMA approach compliant.
Note that the Board’s ruling will focus on “consent or pay” rather than Meta’s implementation. Meta is not the only service offering “consent or pay.” A few European news publishers invented the strategy.
It may have a major impact on the social media behemoth. If the EDPB endorses a controversial model where users must pay for their rights, it could make it more difficult for Meta to claim its subscription tactic is GDPR-compliant, potentially leading to celebrations at 1 Hacker Way as Meta triumphs over Europeans’ privacy.
The rights organizations behind the open letter claim two letters on this issue a few weeks apart show “widespread apprehension about the consequences” when privacy regulators rubberstamped “consent or pay.”.
Privacy rights organization Noyb and others worry that approving the method would allow applications of all kinds to employ economic compulsion to monitor users, destroying major pillars of the EU’s main data protection framework.
Following the Commission’s opening of a DMA investigation into Meta’s use of “consent or pay,” the EU expressed concerns that “the binary choice imposed by Meta’s ‘pay or consent’ model may not provide a real alternative in case users do not consent,” which could lead to the accumulation of personal data and loss of privacy for users.
The letter says the “consent or pay” model payment “could be deemed a degradation of service conditions,” violating DMA Article 13(6). Section “corresponds to the fairness principle under Article 5(1)(a) GDPR.”
The letter states that both statutes adhere to Article 4(11) GDPR, emphasizing the necessity to preserve freely provided consent uniformly under the DMA and GDPR.
The letter also notes that the Commission has previously doubted that consent or pay is “a credible alternative to tracking” in relation to efforts to encourage businesses to simplify cookie consent flows (the “Cookie Pledge”) due to the “extremely limited” number of consumers who agree to pay given how many apps and websites they use daily.
It also notes that the EDPB commented on the Commission’s Cookie Pledge proposal, saying “that this ‘less intrusive’ option should be offered free of charge.”
“This insistence on genuine user choice underscores the fundamental principle that consent must be freely given,” it says. However, the ‘Consent or Pay’ paradigm locks consumers into a coercive dynamic without a choice. Accepting this paradigm undermines consent and promotes a system that prioritizes economic interests above individual rights.”
The Board received “several letters” from civil society groups on this matter, according to a spokesperson. She said that the “consent or pay” opinion “concerns a matter of general application and does not look into specific companies” and that the EDPB would only investigate from a data protection standpoint.
The opinion will discuss the consent or payment models for behavioral advertising on large internet platforms. She stated that the establishment of more general guidelines on consent or pay models would occur later. If an opinion is accepted on Wednesday, there will be administrative work before it can be made public, so a publishing date cannot be certain.
