OPINION 8/2024 – ON VALID CONSENT IN THE CONTEXT OF CONSENT OR PAY MODELS IMPLEMENTED BY LARGE ONLINE PLATFORMS
De Mugurel Olariu, RPD protectie date
During its last plenary session, the EDPB adopted an opinion – Opinion 8/2024 on valid consent in the context of consent or payment models implemented by large online platforms [1] – following a request made pursuant to Article 64 paragraph (2) of the GDPR from the data protection authorities data from the Netherlands, Norway and Hamburg (APD).
The opinion addresses the validity of consent to process personal data for the purpose of behavioral advertising in the context of consent or payment models used by large online platforms.
EDPB President Anu Talus said: “Online platforms should offer users a real choice when using consent or payment models. The models we have today usually require individuals to give all their data or pay. Therefore, most users consent to processing in order to use a service and do not understand the full implications of their choices.”
The EDPB believes that offering only a paid alternative to services involving the processing of personal data for behavioral advertising purposes should not be the default path for controllers. When developing alternatives, large online platforms should consider offering an “equivalent alternative” to individuals that does not involve paying a fee. Where controllers choose to charge for access to the ‘equivalent alternative’, they should give significant consideration to providing an additional alternative. This free alternative should be without behavioral advertising, i.e. with a form of advertising that involves the processing of less or no personal data. This is a particularly important factor in assessing valid consent under the GDPR.
The EDPB emphasizes that obtaining consent does not prevent the controller from adhering to all the principles set out in Article 5 of the GDPR, such as purpose limitation, data minimization and fairness. In addition, large online platforms should also consider compliance with the principles of necessity and proportionality and are responsible for demonstrating that their processing is generally GDPR compliant.
Large online platforms should also consider whether the decision not to give consent may lead the individual to negative consequences, such as exclusion from a prominent service, lack of access to professional networks, or the risk of losing content or connections . The EDPB notes that negative consequences are likely to occur when large online platforms use a “consent or payment” model to obtain consent for processing.
Controllers must also assess on a case-by-case basis whether there is a power imbalance between the individual and the operator. Among the factors to be assessed are the market position of the major online platforms, the extent to which the individual relies on the service and the primary audience of the service.
The EDPB also provides elements to assess the informed, specific and unambiguous consent criteria that large online platforms should consider when implementing consent or payment models.
EDPB President Anu Talus added: “Controllers should be careful at all times to avoid turning the fundamental right to data protection into a feature that individuals have to pay to enjoy. Individuals should be fully aware of the value and consequences of their choices.”
In addition to this Article 64(2) opinion, the EDPB will also develop guidelines on consent or remuneration models with a wider scope and engage with stakeholders on these future guidelines.
[1] https://www.edpb.europa.eu/our-work- tools/our-documents/opinion-board-art-64/opinion-082024-valid-consent-context-consent-or_ro
