The UK’s Information Commissioner’s Office (ICO) has opened a consultation on “consent or pay” business models. We’re sure readers of The Register will have a fair few things to say.
“Consent or Pay” models are where customers are encouraged to part with cash in return for services that don’t involve their data being used for purposes such as advertising.
While the ICO studiously avoided naming any companies or organizations in particular, one of the most famous examples of the practice comes from Meta, which asked EU subscribers to choose between either paying to lose ads and allow data processing for advertising.
The subscription model, which has acquired several nicknames over the months, including “Pay or Okay,” has attracted considerable flack from privacy campaigners as well as several lawsuits – based on EU data prtoection laws.
As the local data watchdog, the ICO has waded into the arguments and asked for views on the model. The situation, it said, is… complicated.
According to the ICO, data protection law “allows for a wide range of different approaches and business models. It balances fundamental rights like the right to privacy with other rights, like the freedom to conduct a business.”
The rules do not prohibit a “consent or pay” model, but it is very important that users understand what the “consent” part of the model actually means and what they are handing over instead of entering a credit card number. It must also be as easy for users to withdraw consent as it is for them to give it – just like under the UK GDPR rules, which are still almost identical to the EU GDPR and were implemented under the Data Protection Act 2018. (Changes to the law can be made post-Brexit, but the country still needs to toe the line or lose its “data adequacy” badge that allows info flows between EU and UK.)
The ICO is kicking things off with four factors for consideration.
How should the fee for dodging personalized ads be calculated?
Are the ad-funded and paid-for services basically the same? If the paid-for version includes extras, then this wouldn’t be the case.
What is the balance of power? It’s hard to give consent freely when there is little choice in whether to use the service or not.
Finally, there is the question of privacy by design and whether users truly understand what data is being collected and for what purpose.
Ultimately, the ICO is pondering how to approach the “consent or pay” business models with regard to data protection law. It said: “This call for views sets out the ICO’s emerging thinking on ‘consent or pay’ business models. It should not be interpreted as confirmation that such an approach is legally compliant.”
Interested parties have until April 17, 2024 to vent their spleen at the ICO.
Or alternatively, you could use the comments section to give your thoughts on the emerging Consent or Pay business models. ®
