Consent or pay – okay for Meta in the UK
ICO gives Meta the green light, but what do other businesses need to consider?
There’s been much debate about Meta’s use of personal information to target Facebook and Instagram users with advertising. Until now, targeted advertising was part of the standard terms and conditions for UK users of these services, but the Information Commissioner’s Office (ICO) says this is not in line with UK law.
Meta is now planning to switch to a ‘consent or pay’ model. A model which many of us are now familiar with when trying to access online newspaper articles. Consent or pay (aka ‘pay or okay’) gives users a choice:
a) consent to being tracked for advertising purposes; or
b) pay for an ad free service; or
c) leave without accessing the content.
It’s a model not without its fierce critics – how can consent be freely given? how can it be a genuine choice? There are clear battle lines between the right to privacy, data protection and ePrivacy laws, and the right to conduct business. The ICO seems to be trying to walk this tight rope.
In a statement the regulator has welcomed Meta’s decision to move to asking for the consent of users for targeting ads, saying;
“People must be given meaningful transparency and choice about how their information is used. At the same time, the ICO recognises that online platforms, like every business, need to operate commercially. There are a number of ways online platforms can do this in compliance with UK law and the ICO’s guidance.
“Under Meta’s chosen approach, people will be able to choose between consenting to personalised ads or paying a monthly subscription for an ad-free service – known as a ‘consent or pay’ model.”
A crucial point for the ICO is the pricing point for those who choose to pay. The ICO asked Meta to set a price which gives people a fair choice. As a result, Meta is said to have significantly lowered the starting price for a subscription, which will be close to half that of EU users.
The ICO says it will continue to monitor the roll-out of Meta’s changes, and indeed other companies’ use of consent and pay models.
4 cornerstones of ‘consent or pay’
“Consent or pay” models can be compliant with data protection law if you can demonstrate that people can freely give their consent and the models meet the other requirements set out in the law.” ICO
If you are using a consent or pay model, or considering implementing it – there’s the potential to find yourself on the regulator’s radar, so it’s worth familiarising yourself with ICO guidance.
This guidance make it clear the right to the protection of personal data needs to be balanced against other rights, such as the right to conduct business. We may have got used to lots of free news content, online games, and other free services, but the ICO recognises organisations should be able to monetise products, and there is no obligation for providers of online services to offer their services for free.
However, the ICO says any decision to adopt the ‘consent or pay’ model must be assessed and documented to make sure it’s compliant with the UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Businesses need to be ready to justify their approach.
The guidance sets out four key areas for an assessment to focus on.
1. Power imbalance: Is there a clear power imbalance between you and the people using your product or service? It’s unlikely that people can freely give their consent if they have no realistic choice about whether or not to use the service. You should especially consider existing users of your product or service under this factor.
2. Appropriate fee: Have you set an appropriate fee for accessing your service without personalised advertising? It’s unlikely that people can freely give their consent if your fee is inappropriately high, making it an unrealistic choice.
3. Equivalence: Is your core service broadly equivalent in the products and services offered where people consent to personalised advertising and where people pay to avoid personalised advertising? You can include additional perks or features in either service, however you should provide an equivalent core service across all options to ensure that people have a free choice.
4. Privacy by design: Do you present the choices equally to people, with clear, understandable information about what each choice means and what they involve? People cannot freely give their consent if they are uninformed about the available options or have their choice influenced by harmful design practices.
What’s clear is the UK ICO is taking a more lenient approach to consent or pay than some of its European counterparts. The model continues to be scrutinised by EU data protection authorities, and is the subject of high-profile complaints by privacy right campaigners. It would be wise to do even more homework if you operate in the EU. European Data Protection Board Opinion on Consent or Pay.
In all of this, while much ‘targeted’ advertising can be innocuous, in some cases ads can cause very real distress and harm when targeting goes awry. The BBC has written here about a case where mothers who lost their babies were still targeted with upsetting baby related content.