A website gives you two choices: accept behavioural advertising or pay. The EDPB has said that, for large online platforms, this binary model will in most cases struggle to produce valid GDPR consent.
"Accept Tracking or Pay" Is Not Automatically Unlawful in Every Case
The European Data Protection Board's Opinion 08/2024 addresses the validity of consent in "consent or pay" models used by large online platforms for behavioural advertising. It does not create a universal EU rule declaring every subscription wall or every pay-or-consent model unlawful.
The EDPB's central concern is whether consent is genuinely free, informed, specific and unambiguous. It says that, in most cases, a large online platform offering only behavioural-advertising consent or a paid alternative will have difficulty demonstrating valid consent.
The EDPB's Preferred Direction: A Real Alternative
The EDPB says large online platforms should consider providing an equivalent alternative that does not require payment. If a controller charges for the non-behavioural-advertising alternative, it should give significant consideration to an additional free alternative, such as advertising involving less or no personal-data processing.
The fee also matters. The EDPB says a fee should not be set so that people feel compelled to consent, and its appropriateness must be assessed case by case, considering fairness, necessity, proportionality, imbalance of power and the consequences of refusing consent.
"Too Expensive" Is Not a Fixed Legal Number
The EDPB does not set a universal euro amount at which a consent-or-pay fee becomes unlawful. It expressly uses a contextual assessment rather than a price cap.
This is important for consumers and publishers: a complaint is stronger when it explains why the concrete price and the surrounding design make consent effectively coerced, rather than simply stating that the fee is "illegal".
Audit the Choice Screen
- Screenshot the first consent/pay screen.
- Record the exact subscription price and billing period.
- Check whether a free non-tracking alternative exists.
- Record how many steps each option requires.
- Save the privacy policy and consent wording.
- Note whether refusing consent causes loss of content, account features or connections.
How to Complain
For an individual GDPR complaint, the relevant national data-protection supervisory authority is normally the starting point. If the controller operates cross-border, the case may enter the GDPR cooperation or One-Stop-Shop mechanism.
The EDPB Opinion is supervisory guidance rather than a private damages decision. A complaint should therefore connect the facts to the GDPR requirements for valid consent and the controller's specific implementation.
What This Means Practically
- Opinion 08/2024 is specifically about large online platforms and behavioural advertising.
- The EDPB does not set a universal subscription-price ceiling.
- A genuine equivalent alternative can be highly relevant to the consent analysis.
- Document the user interface, fee and available alternatives before complaining.
- Use your national supervisory authority for an individual GDPR complaint.
Related Kibbo Tools
Sources
- European Data Protection Board — Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models. edpb.europa.eu
- European Data Protection Board — Consent or Pay models should offer real choice, April 17, 2024. edpb.europa.eu