On 6 March 2024, the ICO issued a call for views on so-called “Consent or pay” models, where a user of a service has the option to consent to processing of their data for one or more purposes (typically targeted advertising), or pay a (higher) fee to access the service without their data being processed for those purposes. This is sometimes referred to as “pay or okay”.

The ICO has provided an “initial view” of these models, stating that UK data protection law does not outright prohibit them. It also sets out factors to consider when implementing these models and welcomes the views of publishers, advertisers, intermediaries, civil society, academia and other interested stakeholders. The consultation is open until 17 April 2024.

The ICO emphasizes that when assessing these models, companies must consider the need to be transparent about the processing and to give people free, meaningful choices about how their data will be used. It identifies the following four specific factors that it expects companies to address when establishing these models, and welcomes feedback on whether other factors should be taken into account:

  • Any imbalance of power between the company and its users. In circumstances where “people have little or no choice about whether to use a service or not”, for example where the provider has a position of market power, the ICO indicates that any consent may not be freely given.
  • Equivalence of the free and ad-funded services. The ICO states that if a paid-for service offers additional benefits beyond not processing personal data for advertising or other purposes—such as additional features not available in the free version—this might affect the validity of consent for the ad-funded service.
  • The level of the fee charged. The ICO states that consent for targeted advertising is “unlikely to be freely given when the alternative is an unreasonably high fee”. The fees should therefore “be set so as to provide people with a realistic choice between the options”. The ICO emphasizes that companies should be able to provide an “objective justification” for the level of the fee.
  • Privacy by design. In any consent request, the ICO emphasizes that choices should be presented equally and fairly, and users should have clear and easily-understandable information about the consequences of each choice. When assessing if companies have complied with this requirement, the ICO is likely to take account of the factors set out in its joint paper with the CMA on harmful design in digital markets.

The ICO also notes that companies will need to think carefully about how to treat existing users of its services. In particular, according to the ICO, companies may need to present the choices in a different way as such users will have different expectations about how the service works compared to new users.

The consultation will be open until 5 pm on 17 April 2024. The ICO states that it will take responses into account in a forthcoming update to its existing guidance on cookies and similar technologies. This ICO process is running in parallel with ongoing discussions about these business models within the European Data Protection Board, which stated in the minutes of its March 2024 plenary meeting that it will issue an Opinion on these models.

*          *          *

The Covington team continues to monitor developments related to online advertising. If you have questions about the consultation, or other matters, we are happy to assist.

Photo of Mark Young Mark Young

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to…

Mark Young, an experienced tech regulatory lawyer, advises major global companies on their most challenging data privacy compliance matters and investigations.

Mark also leads on EMEA cybersecurity matters at the firm. He advises on evolving cyber-related regulations, and helps clients respond to incidents, including personal data breaches, IP and trade secret theft, ransomware, insider threats, and state-sponsored attacks.

Mark has been recognized in Chambers UK for several years as “a trusted adviser – practical, results-oriented and an expert in the field;” “fast, thorough and responsive;” “extremely pragmatic in advice on risk;” and having “great insight into the regulators.”

Drawing on over 15 years of experience advising global companies on a variety of tech regulatory matters, Mark specializes in:

  • Advising on potential exposure under GDPR and international data privacy laws in relation to innovative products and services that involve cutting-edge technology (e.g., AI, biometric data, Internet-enabled devices, etc.).
  • Providing practical guidance on novel uses of personal data, responding to individuals exercising rights, and data transfers, including advising on Binding Corporate Rules (BCRs) and compliance challenges following Brexit and Schrems II.
    Helping clients respond to investigations by data protection regulators in the UK, EU and globally, and advising on potential follow-on litigation risks.
  • GDPR and international data privacy compliance for life sciences companies in relation to:
    clinical trials and pharmacovigilance;

    • digital health products and services; and
    • marketing programs.
    • International conflict of law issues relating to white collar investigations and data privacy compliance.
  • Cybersecurity issues, including:
    • best practices to protect business-critical information and comply with national and sector-specific regulation;
      preparing for and responding to cyber-based attacks and internal threats to networks and information, including training for board members;
    • supervising technical investigations; advising on PR, engagement with law enforcement and government agencies, notification obligations and other legal risks; and representing clients before regulators around the world; and
    • advising on emerging regulations, including during the legislative process.
  • Advising clients on risks and potential liabilities in relation to corporate transactions, especially involving companies that process significant volumes of personal data (e.g., in the adtech, digital identity/anti-fraud, and social network sectors.)
  • Providing strategic advice and advocacy on a range of EU technology law reform issues including data privacy, cybersecurity, ecommerce, eID and trust services, and software-related proposals.
  • Representing clients in connection with references to the Court of Justice of the EU.
Photo of Paul Maynard Paul Maynard

Paul Maynard is an associate in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online…

Paul Maynard is an associate in the technology regulatory group in the London office. He focuses on advising clients on all aspects of UK and European privacy and cybersecurity law relating to complex and innovative technologies such as adtech, cloud computing and online platforms. He also advises clients on how to respond to law enforcement demands, particularly where such demands are made across borders.

Paul advises emerging and established companies in various sectors, including online retail, software and education technology. His practice covers advice on new legislative proposals, for example on e-privacy and cross-border law enforcement access to data; advice on existing but rapidly-changing rules, such the GDPR and cross-border data transfer rules; and on regulatory investigations in cases of alleged non-compliance, including in relation to online advertising and cybersecurity.