Advertising cookies: The ICO raises the question on "Consent or Pay" models
On 6 March 2024, the Information Commissioner’s Office (ICO), the UK’s data protection watchdog, issued a call for views on “consent or pay” models.
The call for views comes in the context of wider regulatory discussion across the EU regarding such models and the requirement for certainty to ensure that businesses are operating compliantly and that their investment in such systems is relevant.
Consent or Pay
In simple terms, consent or pay models are where individuals are given a choice between accessing online services without payment if they consent to their personal data being used for personalised advertising or, if they refuse this consent, having to pay for access that service.
Compliance with Data Protection Laws
The UK GDPR has at its core the principle of safeguarding the data of individuals from misuse. The wording of the Article 4(11) of the UK GDPR defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she by a statement or a clear affirmative action signifies agreement”.
Any organisation wishing to process personal data must have a valid lawful basis for doing so. In the case of consent or pay, the collection of consent must be valid and organisations must ensure that it is ‘freely given’. Consent or pay models can fall foul of this if there is no genuine free choice about whether to receive personalised ads. An example of this can be seen with the use of cookie walls which deny access to a service unless users consent to personalised ads. Cookies walls have on numerous occasions been found to be unlawful. In terms of the ICO’s viewpoint, if your use of a cookie wall is intended to require, or influence, users to agree to their personal data being used by you or any third parties as a condition of accessing your service, then it is unlikely that user consent is considered valid.
The same stance is held by some EU countries on the matter. France by way of The French data protection supervisory authority, the Commission Nationale de l’Informatique et des Libertés (“CNIL”) find that cookie walls where the information provided to users clearly indicate the consequences of their choice and in particular the impossibility of accessing the content or service in the absence of consent is unlawful. The CNIL goes further in indicating that there is no simultaneous collection of a single consent for several processing operations serving distinct purposes (purpose bundling), without the possibility of consenting or refusing per cookies purpose, as such practice is likely to affect users’ freedom of choice and therefore the validity of their consent. Ultimately there must be a real and satisfactory alternative to the user should they refuse the cookies.
Consent or pay models are not, in themselves, unlawful, however their use needs to be carefully balanced against the risk of invalid consent to personalised advertising.
The Four Factors of Interest
As part of its call for views, the ICO has underlined four factors on which it would wish to receive feedback and comment:
1. Power imbalance - In instances where the provider sees itself wielding a majority of the market power and the user is left with little or no choice as to whether to use the service or not the ICO indicates that any consent may not be given.
2. Equivalence - The validity of the consent for the ad-funded service would be questioned by the ICO if such a service offered additional benefits that go beyond not processing data for advertising or other purposes, such as additional features not available in the free version.
3. The fees charged - The ICO asserts that the companies should be able to provide an objective justification for the fee charged and so the consent for targeted advertising is “unlikely to be freely given when the alternative is an unreasonably high fee”. The overhauling idea is that the fees that are set by these companies should be done so “to provide people with a realistic choice between the options”.
4. Privacy by design - The idea that choices should be presented fairly in all consent request is highly stressed by the ICO. Further to this, the supervisory body moves in pressing the idea that users should have clear and easily understandable information about the consequences of each choice made. When assessing if companies have complied with this requirement, the ICO is likely to take account of the factors set out in its joint paper with the CMA on harmful design in digital markets.
What the future holds
The ICO’s call for views will be open until 5 pm on 17 April 2024. The ICO states that it will take responses into account in a forthcoming update to its existing guidance on cookies and similar technologies. This ICO process is running in parallel with ongoing discussions about these business models within the European Data Protection Board (EDPB), which stated in the minutes of its March 2024 plenary meeting that it will issue an Opinion on these models.Here at Gerrish Legal we encourage the initiatives by the ICO and the EDPB and welcome the clarity which will be brought to these models in the near future – the aim is to allow businesses to operate successfully in a commercial online environment with comfort that the options offered to their users fit within defined regulatory frameworks.
How Can Gerrish Legal Help?
We specialise in many aspects of digital law such as GDPR, data privacy, digital and technology law, commercial law, and intellectual property.
We give companies the support they need to successfully and confidently run their businesses whilst complying with legal regulations without the burdens of keeping up with ever-changing digital requirements.
We are here to help you, get in contact with us today for more information.
Article by Wilem Loba, paralegal at Gerrish Legal