The “consent or pay” model raises a difficult question: can a platform ask users to accept behavioural advertising or, if they refuse, pay a subscription? The answer is not automatic. Under the GDPR, consent must be freely given, specific, informed and unambiguous.
In this article we will discuss...
What the EDPB says about consent or pay
The European Data Protection Board adopted Opinion 08/2024 on “consent or pay” models implemented by large online platforms. The central point is that users must have a real choice and that refusal to consent should not lead to disproportionate consequences.
Where a service is important for social or professional life, excluding the user or pushing them to pay may call into question whether consent is truly free.
Why this matters for privacy
Behavioural advertising relies on observing, profiling and segmenting users. A simple accept button is not enough: the platform must explain what data is processed, for what purposes, who is involved and what real alternatives exist.
Key points for companies
- Do not make refusal a lower-quality or hard-to-find option.
- Provide clear information before asking for consent.
- Assess whether an equivalent alternative without behavioural advertising exists.
- Document the legal basis and consent assessment.
- Avoid design patterns that pressure users to accept.
Consent is not resignation
If users accept because they have no reasonable alternative, because they would lose access to an important service or because the interface clearly pushes them to accept, the consent may not be valid.
Conclusion
Privacy should not become a privilege reserved for those who can pay. Companies using consent, subscription or personalised advertising models must demonstrate that user choice is real, transparent and proportionate.
Frequently asked questions
Is consent or pay legal?
For large online platforms, the EDPB (Opinion 08/2024) considers that a binary choice is usually not enough and that a free alternative without behavioural advertising should be offered.
Can any price be charged?
No. The fee must not be so high that it prevents users from making a genuinely free choice.
Is cookie consent still needed?
Yes. Non-essential cookies still require consent under Article 22.2 of Spain’s LSSI.
Does your company need a Data Protection Officer? We act as external DPO for companies and over 30 schools in Spain. See our DPO service.
Auratech Legal Solutions legal team
Lawyers specialised in data protection, compliance and technology law. External Data Protection Officers for companies and schools, whistleblowing channel managers (University Expert in Internal Reporting Systems, UNED) and ISO 27001 / ISO 27701 implementation. Contact us.
