EDSA calls for real choice with consent

Categories:

These are the consequences for online platforms

'Consent or pay' option insufficient?

The user doesn't really have a choice. Give us the Consent to the Processing of your data or pay now is what the big online platforms are increasingly saying. But is such a Consent valid at all? The European Data Protection Board (EDPB) has commented on this.

"As regards the 'consent or pay' models introduced by large online platforms, the EDPB considers that in most cases it will not be possible to meet the requirements for a valid Consent if they only offer users the choice between the Consent into the Processing personal data for behavioral advertising purposes and the payment of a fee", the statement says quite clearly.

Large online platforms should therefore consider providing individuals with an "equivalent alternative" that does not involve the payment of a fee. This free alternative should be without behavioral Advertising be, for example, with a form of Advertisingthat the Processing contains less or no personal data. "This is a particularly important factor when assessing whether a valid Consent after the GDPR is available", the EDSA states.

"Online platforms should give users a real choice when using 'consent or pay' models," summarizes theEDSA Chairwoman Anu Talus summarizes the EDSA's view."The models we have today generally require individuals to either give away all their data or pay for it. As a result, most users agree to the Processing to use a service - and they don't understand the full implications of their decisions," says Talus.

These are the consequences of the EDPB opinion for the major online platforms

But do the major online platforms such as Meta or Google need to act immediately?

In the context of the opinion of the European Data Protection Board (EDPB), the use of "should" generally indicates rather strict Guidelines than legally binding requirements. Although the opinions of the EDPS are very influential and are regarded as authoritative guidance for the interpretation and application of the General Data Protection Regulation, they are not themselves enforceable laws.

In the Opinion, the EDPS uses the word "should" to indicate what he considers to be best practice for online platforms in relation to consent mechanisms. This means that it is a recommended practice and not a binding rule.

However, the recommendations are based on the legal framework of the General Data Protection Regulation, which is enforceable. This means that although the specific recommendations do not constitute legal requirements, they are derived from the legal standards that are required by law, in particular with regard to a valid Consent and the Processing of personal data.

Put simply, if companies do not follow these recommendations, they are not necessarily in direct breach of the legal requirements. However, they run a higher risk of being found to be non-compliant with the legal standards of the GDPR to be classified.

The question remains as to whether, under these conditions, online platform operators within the EU will have any incentive at all to make their services available free of charge in future. For consumers, there is then a risk that in future they will have one less choice instead of one more: All that will be left of 'consent or pay' will be pay. Is this really what consumers in the EU want?

Picture of Aristotelis Zervos
Aristotelis Zervos

Lawyer and editor at 2B Advice

Share this post:

Integrated Risk Management Insider

Do not miss any news in Data protection, Compliance & Risk Management, be the first to receive updates on our solutions and benefit from practical tips from our consultants. 

Register free of charge.

You can also follow us on our social media channels:

Tags:
Share this post :