In the Privacy Soapbox, we give the stage to privacy professionals, guest writers, and opinionated industry members to share their unique points of view, stories, and insights about data privacy. Authors contribute to these articles in their personal capacity. The views expressed are their own and do not necessarily represent the views of Didomi.

 

Do you have something to share and want to take over the privacy soapbox? Get in touch at blog@didomi.io.

 

Providers of free services and content on the internet are facing increasing technical and regulatory challenges when it comes to monetizing their services. Independent journalism in particular, which is crucial for our society and democracy in today's world, is under pressure and is dependent on various sources of income. These include revenue from (consent-based) advertising.

 

"Pay or consent" models in general

 

Under the GDPR and the ePrivacy Regulation, consent is required for a large number of device accesses and data processing operations. The regulatory pressure to obtain consent with the help of consent banners is increasing. For this reason, among others, an approach has become established among service providers in Europe that harmonises the privacy of users and the economic interests of service providers in a legally compliant manner—the so-called "pay or consent" models.

 

The classic "pay or consent" model offers two alternative paths. Either users give their consent to advertising and tracking or they pay a fee for the tracking- and ad-free use of the service. Users can therefore decide at their own discretion how to support journalism.  Whether they pay money for a journalistic service, for example, or use it free of charge, provided they consent to advertising and tracking.

 

In this case, the services are financed indirectly by the advertisers and the users “pay” with their data and attention.

 

contentpass as a sustainable solution for users and service providers

 

The Berlin-based company contentpass is the only independent provider of a cross-website "pay or consent" model in Europe. The contentpass subscription of the same name enables users to surf ad- and tracking-free on more than 450 websites. A large number of websites in Spain have recently gone live with contentpass, as the data protection authority there has increased the pressure on service providers to obtain consent. With contentpass, you get a plug-and-play solution as a publisher and can start the model within a few days. 

 

The subscription currently costs €3.99 per month. This means that users can find out about news, sports, weather, IT news, check their emails, view recipes and much more for less than 1 cent per website. In return, the partner websites receive compensation for the lost advertising revenue from users who have visited their website with a contentpass subscription. The price is calculated on the basis of the average revenue per ad on the respective offer. This type of calculation makes it possible to transparently disclose how the price for the ad-free and tracking-free subscription is derived. This type of price calculation also fulfills the high requirements of the authorities with regard to the assessment criterion of the appropriateness of the alternative like no other.

 

contentpass harmonizes the interests of users in terms of privacy and free access to information and services on the internet with the interests of service providers in refinancing their own services. In the author's opinion, offering users the choice of how they want to consume and thus refinance their services with a cross-website subscription is an embodiment of informational self-determination. At this point, it is important to mention once again that this type of model is not about paying for your own privacy, but about making a self-determined decision as to which content and services are worth paying for as a user, or enabling cross-financing by advertisers by means of my consent to personalized advertising.

 

Thanks to the cross-website approach and the specialization of contentpass on pay or consent as a service, seamless integration with leading consent management platforms such as Didomi is quick and easy. Contentpass thus complements innovative paywall models and strategies and enables continuous adaptation to changing regulations and user preferences. 

 

In addition, the fairer and more transparent pricing model means that small and medium-sized website operators can also opt for such a model. Compared to an in-house implementation, this solution approach is certainly more performant in most cases and, in particular, always up to date with the latest technical and regulatory standards. For this reason, leading global media groups also rely on the expertise and solutions of contentpass.

 

A major advantage of the solution with contentpass is the daily automatic review of your own website with regard to the correct integration of third-party providers so that no data processing requiring consent takes place without the consent of the users. This ongoing external monitoring gives content providers a certain level of security and increases the credibility of the model in that it is intended to be a genuine and free choice for users and that the value proposition is being honored.

 

Status quo of the debate on the permissibility of "pay or consent" models

 

The permissibility and core function of "pay or consent" models were confirmed in a ruling by the ECJ on 4 July 2023. It found that users "can be offered an equivalent alternative that does not involve such data processing operations for an appropriate fee" (para. 150). In addition, the admissibility was already confirmed by the German Data Protection Conference (DSK) in a joint resolution dated 22 March 2023 and the French supervisory authority Commission Nationale de l'Informatique et des Libertés (CNIL) as part of the publication of uniform evaluation criteria on 16 May 2022. The Agencia Española de Protección de Datos (AEPD) endorsed this assessment on 11 July 2023.

 

The European Data Protection Board (EDPB) was asked for an opinion on this by three data protection supervisory authorities in accordance with Article 64(2) GDPR. In addition, a consultation process was also initiated in the United Kingdom by the Information Commissioner's Office (ICO), the UK data protection supervisory authority. 

 

On 17 April 2024, the EDPB published the opinion, which comprises 42 pages. It is an internal EDPB guideline that is binding on the data protection supervisory authorities, but only represents a legal opinion and is not to be understood as a legal obligation. Furthermore, this case explicitly concerns very large online platforms. 

 

The following are the first relevant findings: 

 

  • The statements are repetitive, there are many vague terms and emotional sections
  • This content is based on an aversion to profile-based advertising that is never properly explained
  • In parts, these do not take into account the EDPB's own positioning on Art. 5 (3) ePrivacy Directive
  • The opinion leads to uncertainties where the national regulatory authorities had already previously expressed themselves more clearly, so unfortunately a step backwards. Especially as there is to be a further guideline for all market participants and the content is now more uncertain than ever.
  • The statement ignores the users' ability to act and their free will

 

All in all, it is to be expected that these opinions will be massively challenged in terms of competence and content. This can already be observed. In an article in the German Tagesspiegel newspaper this week, the Hamburg data protection commissioner clearly distanced himself and made it clear that he does not agree with the stricter positioning, that it is literally "no longer his" and is difficult to reconcile with ECJ case law. This shows that there are strongly divergent opinions within the data protection authorities.

 

It remains to be seen what standards the data protection supervisory authorities and courts will ultimately use to assess the voluntariness of consent in individual cases. Criteria such as the appropriateness of the price, the fulfillment of the value proposition, the granularity of consent and a so-called power imbalance are currently being discussed. The last point in particular is questionable as a criterion, as the ECJ expressly recognizes that the dominant market position of a service provider is irrelevant for the effectiveness of consent in connection with a payment or consent model. Further information can be found in the BVDW market overview. 

 

contentpass is one of the most sustainable “pay or consent” solution on the market. The model already fulfills many elements of the EDPB paper and the specific requirements of the national data protection authorities. Like all market participants, contentpass analyses and interprets the EDPB's statement in detail and draws its own conclusions where necessary in order to continue improving the model.

 

Disclaimer: conreri advises a large number of service providers and associations in Europe in the context of "pay or consent" models. Among others, David Pfau has been appointed as external data protection officer at contentpass.