ICO issues guidance on ‘consent or pay’ models

The Information Commissioner’s Office (ICO) has recently issued guidance on ‘consent or pay’ models (Consent or pay | ICO), which are being used by businesses to offer users the choice when wishing to access an online product or service, to either consent to the business using their personal information for personalised advertising, to pay a fee to avoid their personal data being used for such advertising or to not use the relevant online product or service.

Whilst the use of these models is increasing, it has led to data protection queries as to whether valid consent meeting the requirements of the GDPR and ePrivacy Regulations, can be obtained for personalised advertising. Under the GDPR, to be ‘valid consent’ the consent must (amongst other requirements) be ‘freely given’.

In the guidance, the ICO provides some clarity by confirming that these models can be lawful under data protection laws, if the business can show that users can give consent freely in compliance with GDPR. However, this is a high bar as the ICO goes on to set out details of key factors that websites should assess to ensure their models are compliant: power imbalance, appropriate fee, equivalence or core services, and privacy by design. The guidance looks at each of these factors in detail. Any business wanting to adopt a ‘consent or pay’ model should assess the proposed model, taking into account all four factors in the ICO guidance. If a business can demonstrate that its model meets the factors in the guidance, that will help the business to demonstrate that the model meets the requirements for valid consent.

The EU EDPB has already issued guidance on ‘consent or pay’ models opinion (08/2024) but it focusses on ‘large online platforms’ and is a response to particular questions raised, whereas the ICO’s guidance applies to all businesses. The EU’s stance is markedly stricter, casting doubt as to whether a ‘consent or pay’ model adopted by a large online platform could ever be compliant with data protection law and its opinion is already being challenged by industry bodies. Meta has also filed an action against the EDPB seeking annulment of the opinion and payment of compensation, citing (amongst other things) violations of fundamental rights and principles. In the meantime, and whilst we wait for the outcome of those challenges, the differences in the approach of the EU and the UK could ultimately lead to challenges and uncertainty for businesses who are operating in both markets.