In the context of the EDPB’s upcoming Opinion and subsequent Guidelines on the ‘Consent-or-Pay’ model, a number of statements and reports have crystallised why the debate around the ‘Consent-or-Pay’ model rests on postulates that are factually wrong:
This is misleading, since end-users that choose to consent do not on the same occasion waive their fundamental rights over the processing of their personal data. The GDPR precludes unlawful data processing and provides users with the highest level of protection irrespective of the legal basis of the processing, including consent. This means that users that choose to consent do not as a result allow the online content or service provider to ignore the GDPR, since the GDPR and its principles must be complied with at all times.
The “Consent or Pay” model essentially allows end-users to choose freely between two services that are equivalent in terms of content or service provided: one that is funded at least in part by third parties by way of personalised advertising and another that is funded by the end-user directly. The conditions for “freely given” consent under the GDPR continue to be met, as this equivalence ensures that there is no detriment to consenting, not consenting or withdrawing consent: end-users that do not wish to pay or to allow funding through personalised advertising cannot expect to benefit from the online content or service entirely for free.
In other words, there is no “paying” for data protection rights - data protection rights are guaranteed in any event. Conversely the ability to provide end-users with a service free of charge or at a lower cost, due to that service being (partially or fully) funded by advertising, is precisely a circumstance that guarantees the availability of greater choices for end-users irrespective of their financial means.
First, neither the GDPR nor the ePrivacy directive is intended to interfere or influence the business models chosen by companies or to promote particular business models. This is supported by the established positions issued by the CJEU, local regulators, national courts and appeal bodies that do not opine on the type of business models companies must use.
Second, it must be stressed that contextual advertising is not a realistic alternative for many market players. As referenced in IAB Europe’s letter to the EDPB on the ‘Consent-or-Pay’ model, the fundamental right to data protection cannot negate the freedom to conduct business. Not only does it not create the obligation for businesses to provide their services for free, it does not create either the obligation for businesses to provide their services at a loss.
Contextual advertising can arguably work for eCommerce platforms, search engines, single-topic or ‘niche’ services or services that have the financial muscle to produce lifestyle features or other consumer-focused content that lends itself to such advertising. However, other types of services such as serious news content cannot be assigned to commercially interesting topics and are therefore not adequate for contextual advertising.
At the very least, contextual advertising requires the use of information originating from users’ devices which in most cases makes it subject to Article 5(3) of ePrivacy directive and/or the GDPR. For example, ensuring that the same ad does not get shown too often and too many times to the same user (frequency capping) requires storage of information on the user’s device that is generally not considered as strictly necessary by Data Protection Authorities. This is further attested by the EDPB's strict position in its draft guidelines on Article 5(3) of the ePrivacy Directive suggests that the EDPB would require consent for the mere delivery of contextual advertising.
This means that even on digital content or services that may be well-suited for contextual, the selling of non-personalised ad placements especially in the absence of users’ consent cannot generate comparable revenue to personalised advertising, as evidenced by several studies. In environments where the possibility to personalise advertisement is mechanically blocked (e.g. in the absence of cookies or advertising identifiers), ad placements are sold at a significantly lower price, leading to important revenue losses for digital advertising players:
Notwithstanding the fact that neither the ePrivacy directive nor the GDPR forbid or dictate how companies should determine and structure their business models, a correct understanding of how online advertising works and can be viable is an important prior step in order to protect the ability for businesses to maintain a free (or lower-priced) and ad-funded access option to their online content and services - which would otherwise leave end-users with only paid access options.
