Consent-or-pay at online platforms: when is consent still freely given?

A large online platform cannot automatically secure consent for behavioural advertising by offering only a choice between accepting the processing and paying a fee. EDPB Opinion 08/2024 requires a case-specific assessment of whether users can decide freely and what advertising-free alternative is available.

The key questions concern a free alternative without behavioural advertising, economic and social pressure, the amount and effect of a possible fee, separate purposes, understandable information and documented accountability. This is a different issue from the proof and withdrawal of cookie consent or a later marketing objection in a CRM.

Opinion 08/2024 describes consent-or-pay models as offers where a person must choose at least between consent to a specified processing purpose and payment in order to access an online service. The Opinion focuses on processing personal data for behavioural advertising by large online platforms attracting many users in the EEA.

Behavioural advertising typically involves observing activity over time, building profiles and serving advertising based on those profiles. The assessment therefore covers more than the visible advertisement. Tracking, profiling, data sources and disclosures may form part of the same processing operation.

The Opinion was adopted under Article 64(2) GDPR and is EDPB guidance, not a separate statutory obligation. Whether consent is valid depends on the concrete design and the GDPR requirements. Other platform sizes and other purposes require their own assessment.

A platform may present the choice between consent and payment as a genuine choice. The EDPB Opinion says that it should also consider a free alternative without behavioural advertising. If the advertising-free alternative is itself available only for a fee, the platform should consider an additional free option without behavioural advertising. Such an alternative can reduce the pressure arising where a person would otherwise have to pay or give up an important service.

The alternative must be assessed in its actual design. Compare access, functions, quality, information and the processing of personal data. A version is not equivalent merely because it has the same name. If security or other purposes still require processing, those operations need an appropriate purpose, legal basis and transparent explanation.

Network effects and lock-in may be important. Someone who has built contacts, content or professional opportunities on a platform may not experience switching as a realistic equivalent option. Those dependencies belong in the case-specific assessment of free choice.

The Opinion does not set a general euro amount above which a fee would be unlawful. Controllers should assess in the individual case whether the fee makes it harder to refuse consent or effectively pushes the person towards accepting. The effect of the whole model matters, rather than an isolated price comparison.

Relevant factors can include the importance of the service in daily life, dependence on the platform, available alternatives, network effects, earlier free use and the audience. The route to refusal or withdrawal also matters. If acceptance takes one step while payment or refusal involves additional data processing and obstacles, freedom of choice may be affected.

Accountability requires a traceable file. It should record the pricing structure, alternatives considered, effects on user groups, information design and reasons for the conclusion. Businesses set their own prices, but they remain responsible under data protection law for the effect on free choice.

Behavioural advertising should not disappear into a blanket consent request for unrelated purposes. Content personalisation, audience measurement, service improvement and advertising profiles may concern different processing operations. A person should be able to choose which purpose to accept.

Before the decision, the controller, purposes, data types and consequences of the options must be explained in understandable terms. Broad wording such as “commercial purposes” or “personalisation” does not sufficiently describe processing when profiling or tracking follows. Information should also cover changes to the model and the legal basis used for each version.

The interface must not distort the choice through deceptive design. Equally findable routes, clear labels and a comprehensible comparison support an autonomous decision. The interface cannot replace the legal assessment or technical control of data flows.

Article 7(1) GDPR requires a controller to demonstrate consent where processing is based on it. In a consent-or-pay model, records should therefore show which version, purposes, information and technical state applied when the person decided. Article 5(2) GDPR adds responsibility to demonstrate compliance with the principles.

Withdrawal must be possible at any time and as easy as giving consent. It ends consent for the future, while the lawfulness of processing before withdrawal remains unaffected. The platform should record when and to what extent the withdrawal arrived and how the affected data flows responded.

The technical setup must reflect the selected version. A setting in the interface is not enough if tracking, profiling or disclosures continue. For the general structure of consent records, withdrawal and blocking, see the article on cookie consent management. The CRM marketing objection concerns later contact and not the prior freedom-of-choice assessment.

For a focused review, prepare the access versions, pricing structure, user information, purpose and data-flow description, technical configuration, usage assessments and internal case analysis. We compare these documents with the requirements for freely given consent, transparency, granularity and accountability. Contact us with the available documents so that the next steps for your platform can be defined.