EU authorities on “pay or consent”: mid-April 2024 update
Update 2: The EDPB opinion is now available in full.
Update: According to Politico and MLex, the EDPB adopted the opinion I speculated about below. The headlines that this constitutes a prohibition on Meta’s paid subcriptions are misleading. It appears that, as I predicted, the opinion is vague and we will at least need to wait for individual decisions from national privacy authorities.
Due to Meta’s adoption of a “pay or consent” model for Facebook and Instagram, the model became a key issue not only under EU privacy law but also under the new digital regulations: the Digital Services Act (DSA) and the Digital Markets Act (DMA). Given the barrage of pay or consent-related news in the past months, I thought it would be a good idea to take stock of where we are now.
I cover the European Data Protection Board's (EDPB) upcoming opinion and guidelines, the Irish Data Protection Commissioner's investigation, and the European Commission's proceedings against Meta under the DMA and DSA. Additionally, I touch on the possibility of the EU Court of Justice addressing the issue in the ongoing Schrems v Facebook case.
A potentially significant business development is that Meta has offered to lower the price of subscription fees for Facebook and Instagram from EUR 9.99 to EUR 4.99. This price would put them significantly below the no-ads subscription prices of services like Netflix and Disney+ (see “Netflix, Disney+, and Meta: what’s an “appropriate fee” for a subscription?”).
The GDPR (EU level - the EDPB, national investigation - Ireland)
The European Data Protection Board (EDPB). At a meeting in January (minutes), they mentioned preparation for drafting a pay-or-consent guidance document, as well as an “opinion under Article 64(2) GDPR” requested by the Dutch, Norwegian, and Hamburg authorities. Based on their February meeting (minutes), we learned that the opinion “will address the Consent or Pay model in the context of large online platforms” and that the work on the guidance - with a broader scope than large online platforms - will be postponed until the opinion is finalized. The next EDPB meeting will be on 16-17 April, and the pay-or-consent opinion is listed on the agenda as an item “for discussion in view of adoption” (as is, interestingly, a “[l]etter to the BEUC on ‘coordinated GDPR enforcement action against Meta’”). The current deadline for the opinion is around 12 May 2024. In a statement to TechCrunch (published on 15 April), the EDPB spokesperson said that
if an opinion is adopted Wednesday [17 April], there would still be some administrative work to do before it could be made public — declining to confirm a publication date ahead of time.
The guidelines’ drafting process is expected to involve a public consultation. However, past EDPB practice may suggest that the consultation will be unlikely to affect the final result significantly.
What will the EDPB say in their opinion and guidelines? Predicting what the EDPB will say in their opinion and guidelines is not easy, and no reliable leaks have appeared. On one hand, the EDPB could scarcely contradict the EU Court of Justice, which expressly raised the possibility of giving users a choice between paying and consenting to some kinds of data processing (see “Meta’s paid subscriptions. Are they legal? What will EU authorities do?”). Nevertheless, privacy activists are trying to pressure the EDPB to rule that pay or consent is generally incompatible with the GDPR. I don’t expect the EDPB to heed the activists' calls fully. They may, however, try to carve a double standard for large online platforms and the rest of digital services. But I’d expect even the opinion regarding the large platforms to be somewhat vague, not entirely precluding the possibility of pay or consent, thus inviting enforcement actions from national privacy authorities and, ultimately, a ruling from the Court of Justice.
Ireland. An interview given in January by the outgoing Irish Data Protection Commissioner seemed to suggest that the Irish authority will make their Meta/pay-or-consent decision by the time the Commissioner leaves office (19 February 2024). However, there has been no other news about the Irish investigation, not even about the Irish authority submitting a draft decision for consideration by the other EU authorities. The result here will most likely follow the approach that the EDPB decides to adopt (given that the majority of the EPDB can overrule the Irish DPC and force it to change its decision, as they have done previously; see “EDPB: Meta violates GDPR by personalised advertising. A "ban" or not a "ban"?”).
The Digital Markets Act (the European Commission)
In late March, the European Commission announced that they
opened proceedings against Meta to investigate whether the recently introduced “pay or consent” model for users in the EU complies with Article 5(2) of the DMA which requires gatekeepers to obtain consent from users when they intend to combine or cross-use their personal data across different core platform services.
The press release added:
The Commission is concerned that the binary choice imposed by Meta's “pay or consent” model may not provide a real alternative in case users do not consent, thereby not achieving the objective of preventing the accumulation of personal data by gatekeepers.
The Commission is likely relying on the DMA’s preamble (recitals 36-37), which provides that when combining data across different services (and for Meta, Ads were designated as a separate service), “gatekeepers should enable end users to freely choose to opt-in to such data processing and sign-in practices by offering a less personalised but equivalent alternative.”
When announcing the probe, Commissioner Thierry Breton explained:
We have serious doubts that this consent is really free when you are confronted with a binary choice. With the DMA, users who do not consent should be provided with a less personalised alternative of the service, for example financed thanks to contextual advertising. But they do not have to pay.
As Eric Seufert helpfully noted in his article “Europe’s misguided hostility towards Pay or Okay,” this seems to be based on a fundamental misunderstanding of the online advertising market and the limited role of contextual advertising. I also recommend the more lawyerly comments from Peter Craddock. It remains to be seen whether the Commission will keep pressing this point or whether this investigation announcement was mostly intended to score political points before the upcoming EU elections.
The Digital Services Act (the European Commission)
Before announcing the DMA investigation, the European Commission sent Meta a request for information under the DSA. According to the press release:
The Commission is requesting Meta to provide more information related to the Subscription for no Ads options for both Facebook and Instagram.
In particular, Meta should provide additional information on the measures it has taken to comply with its obligations concerning Facebook and Instagram's advertising practices, recommender systems and risk assessments related to the introduction of that subscription option.
This announcement is less specific than the one about the DMA investigation, and it does not identify which DSA obligation(s) the request concerns. One likely rule is Article 38 DSA which states that
providers of very large online platforms and of very large online search engines that use recommender systems shall provide at least one option for each of their recommender systems which is not based on profiling …
As this is not even a formal investigation, perhaps we will not hear more about this (especially after the EU elections).
Bonus: more from the EU Court of Justice?
In February, the Court of Justice held a hearing in the Schrems v Facebook case. The judges reportedly asked the representatives of all parties in that case to comment on Meta’s pay or consent model. This case stems from a legal question referred to the EU Court by an Austrian court in June 2021. Hence it may seem that the technical scope of the case would not include the more recent developments like the adoption of pay or consent. However, the Court may decide to say something about it, as it did in July 2023 in the Meta case (my commentary). A non-binding opinion from the Court’s advocate general is expected on 25 April, and it may give some indication of whether the issue of pay or consent is considered relevant enough within the Court.