Marc Barabas, Associate PeliPartners

The European Data Protection Board recently clarified a series of key issues regarding behavioural advertising, widely used by online platforms. In an opinion published on 17 April 2024, the Board outlined the guidelines to be followed by online platforms when collecting and processing users' personal data to implement behavioural advertising.

Context

The Board's opinion responds to the requests received from data protection authorities in the Netherlands, Norway, and Germany to examine the 'consent or pay' option currently used by online platforms in the context of behavioural advertising.

Specifically, the authorities' question was whether the option offered by online platforms to users to either consent to data processing for the purpose of behavioural advertising or to pay a fee to opt out of data processing constitutes valid consent in the meaning of the GDPR.

Behavioural advertising in the view of the European Data Protection Board

” Behavioural advertising is essentially a form of profiling, involving the processing of a large amount of data, derived from the analysis of the activity and behaviour of data subjects in the online environment (data such as the number of visits or time spent on a website, the location, or the pages the respective person likes or follows). It should be noted that this data collection is not limited to the monitoring of users' behaviour exclusively on the platforms in question, but may also extend to their activity on other websites, even those owned by other operators”, stated Marc Barabas, Associate PeliPartners.

By monitoring and compiling this data, online platforms such as Facebook, Instagram or LinkedIn then create, with the help of third-party operators, a profile of each user in order to display ads and adverts tailored to their specific interests.

Both the Board and other data protection authorities consider behavioural advertising to be one of the most intrusive forms of advertising, precisely because of its potential to provide a very detailed picture of users' personal lives and preferences. In this respect, the authority pays particular attention to the legal basis on which the data processing is carried out, especially as regards the validity of users' consent.

Consent in the context of behavioural advertising 

The model most commonly used by online platforms to obtain user’s consent in the context of behavioural advertising is the "consent or pay" one. Users are thus put in the position of either agreeing to the monitoring of their online behaviour or paying a fee in order to continue to use that online platform.

The Board identified several shortcomings of such a mechanism. Firstly, the authority made it clear that the processing of personal data cannot be used as a means of financial gain. In this respect, providing only one alternative to users, subject to a fee, to avoid data processing, cannot be the default option for operators.

With regard to the consent itself, the Board considers that such a mechanism may affect its validity, given that: 

users would suffer a financial “detriment” if they do not consent to the processing of data, in the form of the fee they will be obliged to pay for using the platform;

in many cases, there is an imbalance of power between users and online platforms; moreover, in its judgment of 4 July 2023 in Case C-252/21 concerning Meta Platforms, the Court of Justice of the European Union stated that platforms which hold a dominant position in a particular market may affect the freedom of users' consent precisely because of the power and influence they have in the online environment; 

consent is often not sufficiently specific and informed, given the significant amount of data being processed and the numerous ways in which data is collected. 

The authority's proposed solutions for compliance with GDPR standards 

In this context, the Board offers a number of guidelines and solutions that online platforms can implement to ensure compliance of their activity with data protection legislation: 

presenting users with an alternative way of operating the application, which does not involve any or only entails a reduced amount of data processed for behavioural advertising purposes; the alternative must be equivalent, with the same functions and features, so that users have a real choice; 

a free equivalent option, advisable from the Board's perspective, will have a significant impact on the analysis of the validity of consent; if a fee is nevertheless opted for, operators should set an amount that is not likely to discourage a freely given consent, turning the option into a premium version of the platform; the analysis of the amount will be carried out on a case-by-case basis by operators or data protection authorities; 

the alternative offered may involve various other forms of advertising such as contextual advertising or advertising based on certain topics of interest that the user selects from a list of topics proposed by the platform; 

users must be informed of all purposes, categories of data and recipients to whom the data are transferred, avoiding the expression of a general consent encompassing all processing activity for the purpose of behavioural advertising; 

ensuring that the withdrawal of consent is equally easy and freely available to users, without the pressure that withdrawing consent would automatically entail the payment of a fee or the inability to use the platform.