“Cookie consent or pay” – Is it lawful?
This blog looks at cookie compliance and the rise of the consent or pay model. Learn how this new approach impacts user privacy, data protection, and business revenue while balancing lawful consent under GDPR.
Cookie compliance has been the focus of the Information Commissioner’s Office (ICO) for a while. In November 2023, the ICO wrote to some of the UK’s top websites to inform them they faced enforcement action if they did not make changes to comply with data protection law. The focus was for organisations to proactively make advertising cookies compliant – giving users a fair choice over whether they consent to use cookies and being tracked for personalised advertising.
For businesses, especially those offering free content, cookies are a crucial revenue tool. By tracking users’ online activities, companies can serve personalised ads, and third-party ads (paid for by the advertiser to the organisation) thereby increasing the likelihood of clicks and conversions and revenue. The issue now is that website users are increasingly “rejecting all” cookies, a disaster for organisations who are not only losing valuable clicks and conversions but advertisers paying less to the website owners if they are finding a drop in conversation rates too.
However, now there is a shift by these organisations to maintain their revenue, in the form of “Consent or Pay”. Users are still given a choice, but now it’s either “consent to cookie tracking or pay for an ad-free experience”. This approach seemingly aims to address the challenge of maintaining revenue while respecting user privacy. But it has sparked significant debate…
Is the consent or pay model fair and lawful?
The Privacy & Electronic Communications Regulation states that the UK GDPR definition of consent applies, therefore it must be freely given, specific, informed and an unambiguous indication that the individual agrees by way of clear affirmative action to be tracked. It also means that consent should be as easy to withdraw as it was to provide it. The risk for organisations is that individuals are forced to consent where they cannot afford to pay, meaning consent is not freely given, therefore contravening data protection law.
Consideration also needs to be given to potential inequality, where only those who can afford to pay are granted full privacy. This could create a two-tiered internet, where privacy becomes a luxury rather than a right. In reality, the consent or pay model means website users are still paying for content, either with their personal data or with their money. Therefore, a balance will need to be struck where consent is genuinely informed and freely given and not influenced by financial pressure.
In March 2024, the ICO launched its call for views on the “consent or pay” model, which has now closed. We are still waiting for the ICO’s views on this emotive subject, which may also result in changes to the Guidance on the use of cookies and similar technologies on how organisations ensure their consent or pay models align with data protection and e-privacy law.
In considering this issue from an EU perspective, readers may be aware that the European Data Protection Board (EDPB) has already given its view. In its Opinion on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms 08/2024 edpb_opinion_202408_consentorpay_en.pdf (europa.eu) adopted on 17th April 20204, the EDPB concluded that “… in most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to the processing of personal data for behavioural advertising purposes and paying a fee…” and that they should consider providing users with an “equivalent alternative” that does not include paying a fee. The EDPB also stated that “personal data cannot be considered as a tradeable commodity, and that platforms should bear in mind the need of preventing the fundamental right to data protection from being transformed into a feature that data subjects have to pay to enjoy.” We will wait to see if the ICO adopts a similar view.
Do you need help with cookie compliance notices?
If you need to update your privacy policy and cookie consent settings to ensure compliance with Data Privacy regulations such as GDPR, we can help.
