Pay or consent offering and the legal challenge of free and genuine choice

2023 had a significant privacy weight for Meta. Regulators from different European countries penalised the Californian technology conglomerate for inadequate data processing practices. The lawfulness of combining data across Meta’s suite of social platforms for personalised advertising purposes, dubbed as super-profiling, was at the core of privacy and competition actions ultimately decided upon by the Court of Justice of the EU (CJEU) in its landmark Decision C-252/21. 

In its ruling, CJEU appreciated that the controller’s dominant position on the market creates the presumption of a clear imbalance between its users and the controller. This circumstance might amount to insidiously pressurising individuals into providing their consent to processing activities to which otherwise, they would not consent. The controller has the burden of proving otherwise. 

That is to say that, for the processing at hand, as with regards to the applicability of Article 6 of the GDPR, all lawful bases other than consent, have been ruled out by the CJEU. In other words, CJEU decided that “consent is the only appropriate lawful basis for the tracking and profiling driven ‘personalized’ content and behavioural advertising that Meta monetizes.” 

CJEU decision was appreciated as giving the authorities a leverage in prohibiting personalised advertising by large digital service providers, like Meta, unless a valid consent is obtained under the auspices of Article 7 of the GDPR. 

Most importantly, the CJEU judgement underscores the premises that the market power should play a role in the assessment of the validity of (i.e., freely given) consent. 

By the moment of the ruling, Meta, forced by the circumstances outlined at the beginning of this text, changed its data processing lawful basis from contractual necessity to legitimate interest and finally, in the aftermath of CJEU Decision C-252/21, to consent. Nevertheless, Meta’s consent proposition is energetically contested by activists and data privacy pundits who have been quick to note that it requires users to pay monthly subscriptions to access advertising free versions of Meta’s products. It is worthwhile mentioning that the subscriptions fee is quite consistent while no breakdown of the costs is available, let alone that users are asked to subscribe for each Meta account they own (i.e., Facebook, Instagram). 

Meta’s ad-free subscription for regional users has an initial cost of €9.99/month on web or €12.99/month on iOS or Android per linked Facebook and Instagram accounts in a user’s Accounts Centre (with an additional fee of €6/month on web and €8/month on iOS or Android set to apply for each additional account listed in a user’s Account Centre from March next year. 

From a legal standpoint, there are multiple issues vis-à-vis what Meta interprets to be “a subscription service as part of a model to obtain valid consent.” 

Recital 43 of the GDPR provides that: “In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all circumstances of that specific situation.” 

Regarding the latter, in its Guidelines 05/2020 on consent under Regulation 2016/679, version 1.0, adopted on 4 May 2020, paragraph 21, the European Data Protection Board, clarifies that: “Imbalances of power are not limited to public authorities and employers, they may also occur in other situations. As highlighted by the WP29 in several Opinions, consent can only be valid if the data subject is able to exercise a real choice, and there is no risk of deception, intimidation, coercion, or significant negative consequences (e.g. substantial extra costs) if he/she does not consent. Consent will not be free in cases where there is any element of compulsion, pressure, or inability to exercise free will.”