EU tells Meta it can't paywall privacy

The EU's Data Protection Board (EDPB) has told large online platforms they should not offer users a binary choice between paying for a service and consenting to their personal data being used to provide targeted advertising.

The EDPB opinion [PDF] published yesterday addresses whether it is valid in terms of data protection law to process personal data for the purposes of behavioral advertising in the context of "consent or pay" models as introduced by Meta.

It followed requests by the Dutch, Norwegian, and Hamburg Data Protection Authorities and complaints about Meta, the social media company that owns Facebook, WhatsApp, and Instagram.

"Most users consent to the processing in order to use a service, and they do not understand the full implications of their choices," EDPB chair Anu Talus said in a statement.

The request from data protection authorities followed complaints by consumer and privacy organizations about Meta's decision to introduce a so-called "pay or okay" model.

In October last year, the social media giant said it would be possible to pay Meta to stop Instagram or Facebook feeds of personalized ads and prevent it from using personal data for marketing for users in the EU, EEA, or Switzerland.

Meta then announced a subscription model of €9.99/month on the web or €12.99/month on iOS and Android for users who did not want their personal data used for targeted advertising.

EDPB said, in the majority of instances, it would not comply with the legal requirements for valid consent in the use of personal data if they confront users only with a choice between consenting to the processing of personal data for behavioral advertising purposes and paying a fee.

"In most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice," the opinion said.

But a Meta spokesperson said: "Last year, the Court of Justice of the European Union ruled that the subscriptions model is a legally valid way for companies to seek people's consent for personalized advertising. Today's EDPB opinion does not alter that judgment and subscription for no ads complies with EU laws."

Meta is expected to continue engaging with the Irish Data Protection Commission, its lead regulator in the EU. The opinion is not anticipated to have an impact on Meta's services.

In November last year, privacy activist group noyb (None Of Your Business) filed a complaint with the Austrian data protection authority against Meta for introducing the subscription model.

At the time, Felix Mikolasch, data protection lawyer at noyb, said: "EU law requires that consent is the genuine free will of the user. Contrary to this law, Meta charges a 'privacy fee' of up to €250 per year if anyone dares to exercise their fundamental right to data protection."

In February, consumer groups filed their own complaint to stop Meta giving EU users a "fake choice" between the subscription offer and consenting to being profiled and tracked via data collection.

Complaints filed by eight European Consumer Organisation (BEUC) members are based on the EU's General Data Protection Regulation (GDPR). They argue that Meta's pay-or-consent model breaches data protection principles of the law, including the principles of purpose limitation, data minimization, fair processing, and transparency, with said processing enabling the company to "infer private details about the consumer." ®