“Pay or Consent” business models under scrutiny by consumer authorities and data protection regulators

Last month, the European Commission published a press release announcing that the Consumer Protection Cooperation Network (“CPC Network”) had sent a letter to Meta over concerns that the tech giant's new “pay or consent” business model may breach EU consumer law. 

This latest development comes following ongoing scrutiny of Meta’s pay or consent business model from consumer authorities and data protection regulators.

Background

In November 2023, Meta introduced a “pay or consent” advertising model requiring users to pay for using Facebook or accept that their personal data would be used and targeted for personalised ads. This prompted widespread complaints and led to almost 20 consumer organisations banding together to file complaints with the CPC Network, a network of authorities responsible for the enforcement of EU consumer protection laws.

Meta’s pay or consent model is under separate investigation by a number of regulatory bodies – including the European Commission, who last month issued its preliminary view that the binary advertising option presented to users fails to comply with the Digital Markets Act. There is also a separate investigation ongoing by the European Commission to assess Meta’s compliance with the Digital Services Act, in particular, in relation to Facebook and Instagram’s advertising practices, recommender systems and risk assessments related to the introduction of the pay/subscription option.

In addition, the UK Information Commissioner’s Office (“ICO”) and the European Data Protection Board (“EDPB”) are both currently addressing data protection issues raised by this model.

A number of online publications in the UK had adopted similar pay or consent models including some major news organisations.

Consumer complaints

The CPC Network have identified a number of concerns with Meta’s pay or consent model which could potentially be considered unfair and contrary to both the Unfair Commercial Practices Directive and the Unfair Contract Terms Directive. This includes: 

1. Misleading by the use of the word “free”: users who do not want to pay a fee are required to accept that Meta can make revenue from using their personal data to show personalised ads. The CPC suspects this could be misleading since Meta requires consumers to accept that it can make revenue from using their personal data to show them personalised ads if they choose not to pay for the ad-free versions of the services.
2. Lack of accessibility: users must navigate a numerous hyperlinks leading to different sections of Meta’s Terms of Service or Privacy Policy in order to gauge how their preferences, their personal data, and user-generated data will be used by Meta to show them personalised ads. 
3. Imprecise language: consumers may be misled by imprecise language such as “your info” to refer to their personal data, or by suggesting that users who decide to pay will not see any ads when in reality they may still see ads when engaging with content shared via Facebook, Instagram or other members of the platform. 
4. Pressuring consumers: users who have always used Facebook or Instagram free of charge are pressured into making an immediate choice in respect of the new business model. Until that choice is made, users cannot access their accounts, which raises concerns about users not being provided with sufficient warning or time, or a real opportunity to consider how each option will impact their contractual relationship with Meta. 

Meta has been given until 1 September 2024 to respond to the CPC Network’s letter and the European Commission with proposed solutions to the key issues above. 

ICO’s position on Pay or Consent 

Meta’s pay or consent model has not yet been rolled out in the UK. Albeit, as mentioned above, a number of UK online publications have adopted similar pay or consent advertising models. 

In March this year, the ICO launched a public consultation calling for views on consent or pay business models to develop its regulatory position. The ICO is expected to issue its views in updated guidance on cookies and similar technologies later this year.

In the interim, the ICO has expressed an initial view that whilst consent or pay models are not prohibited by data protection laws in principle, for consent to be valid, it must be freely given, fully informed and capable of being withdrawn without detriment. The pay or consent model does raise questions around whether consent is “freely given” and whether users do have real choice when deciding whether or not to consent. This will come down to various factors, including the balance of power between the service provider and use, and the fees being charged. 

What should organisations using pay or consent need to consider? 

Online platforms that operate a “consent or pay” model should take note of initial views expressed this year by the ICO, and look out for ICO’s final guidance which is expected to be issued later this year. 

The ICO’s initial views helpfully included factors which organisations should be thinking about with a pay or consent model. In particular:

• Power balance: organisations need to consider the service being offered and whether there is a clear imbalance of power with the user. The ICO considers that consent for personalised ads is unlikely to be freely given when people have little or no choice about whether to use a service or not, which could be the case when they are accessing a public service or the service provider has a position of market power.
• Appropriate fee: fees should be appropriate. The ICO’s view is that consent for personalised ads is unlikely to be freely given when the alternative is an “unreasonably high fee”. Service providers should be able to provide objective justification for the amount of fees charged. Meta have reportedly proposed to reduce its monthly subscription fee from €9.99 to €5.99 to address these concerns.
• Transparency: choices must be presented fairly and equally and users should be given clear information about their options and how their personal information will be used in each case. 

The points raised by the CPC Network are distinct, and focus on different underlying obligations, but also highlight areas of consideration to demonstrate compliance with consumer legislation. The format, timing and approach to implementation or administration of a pay or consent offering will all factor into any assessment as to whether it is misleading or compliant with the requirements of consumer legislation.  

We await Meta’s response to the CPC Network and any proposed changes to the model to alleviate concerns. 

If you would like any further information or have queries on the content of this article, please contact Richard Hugo, Amanda Leiu or a member of our Commercial & Technology team.

This article was written by Pooja Bokhiria, Amanda Leiu and Richard Hugo.