Meta’s ‘consent or pay’ policy must not override privacy, EU rights group warns

Nearly two dozen civil society groups and non-profit organizations have written an open letter to the European Data Protection Board (EDPB) urging it not to endorse a strategy used by Meta that they say is designed to circumvent EU privacy protections for commercial gain.

The letter comes ahead of an EDPB meeting this week, which is expected to provide guidance on a controversial tactic used by Meta to force Facebook and Instagram users to consent to its tracking.

A similar open letter to the EDPB was signed in February by a number of signatories, including EDRi, Access Now, noyb and Wikimedia Europe. But the board is expected to adopt an opinion on so-called “agree or pay” (aka “pay or consent”) as soon as Wednesday, so it could be the last chance for rights groups to influence hearts and minds on an issue, they warn. This is “crucial” for the future of data protection and privacy in Europe.

“As you prepare to develop guidance on the ‘consent or pay’ model, we urge you not to endorse strategies that circumvent EU data protection regulations solely for commercial advantage and to advocate for strong safeguards,” the open letter reads. Prioritize data subjects’ rights of agency and control of their information. “Emphasizing the need for genuine choice and meaningful consent is consistent with the fundamental principles of data protection legislation, the broader context of all relevant EU Court of Justice rulings, and helps safeguard the fundamental rights of individuals across the European Economic Area [European Economic Area],” it continued.

Meta spokesman Matthew Pollard said in an emailed statement that the company’s offer, called an “ad-free subscription,” complies with EU law: “‘Ad-free subscription’ addresses leading European businesses The latest regulatory developments, guidance and judgments shared by regulators and courts in recent years. Specifically, it complies with directives from Europe’s highest court: In July, the Court of Justice of the European Union (CJEU) approved subscription models as a basis for people to consent to personalized advertising. A way of data processing.”

Meta’s pay-or-consent strategy has been met with numerous complaints since it launched its “ad-free” subscription service last fall. Additionally, in a notable step last month, the EU launched a formal investigation into Meta’s tactics, seeking to determine whether it breached the rules applicable to Facebook and Instagram under the Competition-focused Digital Markets Act (DMA). obligation. The investigation remains ongoing.

The EU has also recently questioned Meta’s use of its supervisory powers for “consent or pay” which enable it to monitor large platforms’ compliance with the Digital Services Act (DSA), a sister regulation to the DMA that also applies to Meta social networks, Facebook and Instagram.

The Commission’s opinion on “consent or pay” is expected to provide guidance on how the EU General Data Protection Regulation (GDPR) should be applied in this area. However, it also looks relevant to the DMA, as the new market competition law builds on the EU’s data protection framework – referring to concepts set out in the GDPR, such as consent.

This means that guidance provided by the EDPB (a GDPR-focused guidance body) on how (or indeed whether) the “consent or pay” model complies with EU data protection rules may have wider implications for whether the mechanism is ultimately considered compliant The Significance Committee made this request when evaluating Meta’s DMA approach.

It is important to note that the Board’s opinion will generally consider “agree or pay,” rather than specifically investigating the deployment of Meta. Meta isn’t the only service provider pushing “consent or pay” to users, either. This strategy was actually pioneered by a handful of European news publishers.

Still, this could have a significant impact on the social networking giant. This could make it harder for Meta to claim its subscription strategy is GDPR compliant, or if the EDPB ends up supporting a controversial model where users have to pay to get rights, 1 Hacker Way will surely pop the champagne corks as metadata overrides on the privacy of Europeans.

The rights group behind the open letter said two letters on the topic, written weeks apart, reflected “widespread concerns” about the consequences of a “consent or pay” rubber stamp from privacy watchdogs.

Privacy groups, noyb and others warn that if the strategy is approved, it will open the floodgates for a variety of apps to use economic coercion to force users to be tracked, undermining a key pillar of the EU’s flagship data protection regime.

The letter points to concerns expressed by the European Commission after launching a DMA investigation into Meta’s deployment of a “consent or pay” model, in which the EU expressed concern that “Meta’s ‘pay or consent’ model imposes a binary choice that may not be available if the user does not consent.” , there are real alternatives”, thus potentially leading to the continued accumulation of personal data and the loss of user privacy.

The letter argued that payments relied on in a “consent or pay” model “could be considered a degradation of the conditions of service”, suggesting a breach of Article 13(6) of the DMA. This section “is consistent with the fairness principles set out in Article 5(1)(a) of the GDPR.”

“Given that both Bills refer to Article 4(11) of the GDPR, this highlights the urgent need to protect freely given consent consistently in the context of the DMA and GDPR,” the letter reads.

The letter further points out that when it comes to encouraging companies to simplify the cookie consent process (also known as the “Cookie Pledge”), the Commission has previously expressed doubts about whether consent or payment are “reliable alternatives to tracking” because it is “extremely limited.” The number of consumers who agree to pay based on the number of different apps and websites they may use on a daily basis.

It also noted that the EDPB’s response to the Commission’s Cookie Commitment proposal contained what they said was a clarification that “this ‘less intrusive’ option should be made available free of charge.”

“This insistence on true user choice underscores the fundamental principle that consent must be freely given,” it continued. “However, the current ‘consent or pay’ model is coercive and leaves users with no real choice. The continued acceptance of this model undermines the fundamental principle of consent and perpetuates a system where commercial interests take precedence over individual rights.”

A spokesman for the commission confirmed it had received “several letters” from civil society organizations on the subject. She also tells us about her opinion on “agree or pay”It deals with issues of general application and will not target a specific company”, stressing further: “The EDPB will only investigate this matter from a data protection perspective. “

“The opinion will address the use of consent or payment models by large online platforms for behavioral advertising purposes. More general guidance on consent or payment models will be adopted at a later stage,” she added, suggesting that if the opinion is adopted on Wednesday , which still needs to do some administrative work before going public – declined to confirm a release date in advance.

This report was updated after the EDPB responded to our request for comment and clarification