For the attention of the European Data Protection Board (EDPB),
We, the undersigned organisations, are writing to you regarding the opinion you are developing on “Pay or Consent” models. We urge members of the European Data Protection Board (EDPB) to issue an opinion that clearly confirms the incompatibility of these models with the General Data Protection Regulation (GDPR) and the essence of fundamental rights, as enshrined in Article 52 of the EU Charter of Fundamental Rights. The EDPB’s opinion on this matter will be decisive for ensuring the future of the right to privacy around the world, and will be crucial for preventing other large online platforms from following Meta’s example of a “Pay or Okay” model.
We recognize that the opinion that the EDPB is developing, following a request by three national data protection authorities (DPAs) based on Article 64(2) of the GDPR, to specifically address large online platforms’ models. In the opinion, particular attention must be given to Meta’s consent-based proposal, because most large online platforms are now trying to copy Meta’s “Pay or Okay” model launched in October 2023. This is due to Meta’s ability to drive competitors to adopt similar models due to its dominant position. Such subscription models force people to pay money to effectively “buy” their right to privacy that is enshrined in the Universal Declaration of Human Rights (Article 12), the European Convention of Human Rights (Article 8) and the European Charter of Fundamental Rights (Article 7 and 8). Those who refuse to pay for their rights, or cannot afford to, are forced to be invasively tracked, surveilled, and targeted with advertisements.
In its assessment of these models, the EDPB should carefully take into account two considerations. Firstly, that these “Pay or Consent” subscription models are specifically in contrast with the principles of privacy and data protection developed in the GDPR and, secondly, that they are in contradiction with the essence of fundamental rights as enshrined in Article 52 of the EU Charter.
To the first point, these “Pay or Consent” models are completely at odds with the GDPR’s principle of consent. Forcing people to pay a fee to refuse consent renders compliance with Article 4(11) of the GDPR unattainable. In such models, consent will never be able to fulfil the condition of “freely and expressly given.” In addition, coercion is very clearly in contrast with the meaning of genuine and active consent, as underlined in Recital 42 of the GDPR and reinforced by the EDPB’s “Guidelines 05/2020 on consent under Regulation 2016/679”. This was repeatedly confirmed in courts, including in the recent Bundeskartellamt Court of Justice of the European Union (CJEU) case. As such, “Pay or Consent” models remove a person’s right to have “genuine and free choice” that is “expressly given,” limiting choice and agency over their data, and thus taking the GDPR in the exact opposite direction to the one for which it was created. Accepting these subscription models would undermine the GDPR, downgrade the EU’s high data protection standard, and “wash away all realistic protections against surveillance capitalism.”
A second argument for EDPB members to carefully consider is that these models are incompatible with the essence of fundamental rights as a whole, which is protected by Article 52 of the EU Charter. As reiterated by the EDPB, the Fundamental Rights Agency, the Council of Europe, the UN Special Rapporteur on counterterrorism, and multiple times by the CJEU, even if the EU Charter or any other instrument allows for restrictions to rights when specific criteria for justifications are fulfilled, in primis the essence of a right must always be respected. If this is compromised, then any action is directly considered unlawful. By forcing people to purchase their own rights, these subscription systems normalise a transformation of rights into commodities. They shift the narrative on which human rights were created, challenging their inalienable nature and the principle that they are intrinsic to a person by the very fact of human existence. Putting our right to privacy up for sale directly compromises the essence of the right and compromises the essence of human rights in general. No one can sell our rights because they are, by definition, inalienable. The rights enshrined in Article 7 and 8 of the Charter should therefore be enjoyed by all and no price tag should ever be placed on them.
When we consider the overall impact this opinion will have on platforms operating worldwide, the EDPB’s role in opposing these subscription models becomes even more crucial, impacting not only the EU. The EDPB’s voice in this opinion will be important to avoid a negative impact on the overall respect and progress of the right to privacy worldwide.
This reframing of privacy as a luxury good has profoundly negative effects. As already mentioned by our partner NGOs, “fundamental rights are not reserved to people that can afford it.” The framing of privacy as a paid service further widens and deepens social inequalities, as well as discriminatory exclusion related to the enjoyment and accessibility of rights in the digital space.
For all of the aforementioned reasons, we urge the EDPB and all supervisory authorities (SAs) to firmly oppose “Pay or Consent” models. Finally, we also demand that the EDPB reiterates and includes these limits in the Guidelines on the topic with a broader scope, to be developed after the opinion, as agreed during the February 13, 2024, EDPB plenary.
Yours sincerely,
Signatories
- Access Now
- EDRi European Digital Rights
- Bits of Freedom
- Deutsche Vereinigung für Datenschutz e.V. (DVD)
- Digitalcourage
- Electronic Frontier Norway
- Föreningen för digitala fri- och rättigheter (DFRI)
- Homo Digitalis
- IT-Pol Denmark
- La Quadrature du Net
- noyb – European Center for digital Rights
- Politiscope
- Wikimedia Europe