On 6 March 2024, the ICO issued a call for views on so-called “Consent or pay” models, where a user of a service has the option to consent to processing of their data for one or more purposes (typically targeted advertising), or pay a (higher) fee to access the service without their data being processed for those purposes. This is sometimes referred to as “pay or okay”.

The ICO has provided an “initial view” of these models, stating that UK data protection law does not outright prohibit them. It also sets out factors to consider when implementing these models and welcomes the views of publishers, advertisers, intermediaries, civil society, academia and other interested stakeholders. The consultation is open until 17 April 2024.

The ICO emphasizes that when assessing these models, companies must consider the need to be transparent about the processing and to give people free, meaningful choices about how their data will be used. It identifies the following four specific factors that it expects companies to address when establishing these models, and welcomes feedback on whether other factors should be taken into account:

• Any imbalance of power between the company and its users. In circumstances where “people have little or no choice about whether to use a service or not”, for example where the provider has a position of market power, the ICO indicates that any consent may not be freely given.
• Equivalence of the free and ad-funded services. The ICO states that if a paid-for service offers additional benefits beyond not processing personal data for advertising or other purposes—such as additional features not available in the free version—this might affect the validity of consent for the ad-funded service.
• The level of the fee charged. The ICO states that consent for targeted advertising is “unlikely to be freely given when the alternative is an unreasonably high fee”. The fees should therefore “be set so as to provide people with a realistic choice between the options”. The ICO emphasizes that companies should be able to provide an “objective justification” for the level of the fee.
• Privacy by design. In any consent request, the ICO emphasizes that choices should be presented equally and fairly, and users should have clear and easily-understandable information about the consequences of each choice. When assessing if companies have complied with this requirement, the ICO is likely to take account of the factors set out in its joint paper with the CMA on harmful design in digital markets.

The ICO also notes that companies will need to think carefully about how to treat existing users of its services. In particular, according to the ICO, companies may need to present the choices in a different way as such users will have different expectations about how the service works compared to new users.

The consultation will be open until 5 pm on 17 April 2024. The ICO states that it will take responses into account in a forthcoming update to its existing guidance on cookies and similar technologies. This ICO process is running in parallel with ongoing discussions about these business models within the European Data Protection Board, which stated in the minutes of its March 2024 plenary meeting that it will issue an Opinion on these models.

*          *          *

The Covington team continues to monitor developments related to online advertising. If you have questions about the consultation, or other matters, we are happy to assist.