“Pay or data” and cookie walls are clearly controversial topics, but I feel something needs to be said regarding their justification – else LinkedIn and the broader web may seem to be a very anti-business environment from a data protection perspective, based on various posts and articles I have seen in recent months.
Running a business has a cost, and each business decides how to recover that cost and make a profit. In practice, that can be done by asking customers to pay, or finding money another lawful way (e.g. through advertising).
That service or product that the business is offering? You may perhaps be allowed to get it, but you are in no way entitled to it unless a specific law explicitly says so (e.g. “universal service” situations).
So if a business decides to offer you a choice between paying and allowing profile-based advertising, you have no right to demand access for free without profile-based advertising – or even to circumvent technical measures to prevent unauthorised access (such as a paywall).
Yes, there may be caveats – a company with significant market power may have less freedom in determining pricing than a company with lower market share. Yes, it is good practice to document how a company reaches a particular price point.
But no, you as an individual are not in a better position to determine what is correct pricing or what is the amount of profile-based advertising that is acceptable. I’m even skeptical that data protection supervisory authorities have any right or authority to determine what is fair and proportionate pricing, even for dominant firms, but I guess that will be subject to further discussion before the courts.
Paywalls and circumvention measures
On principle, I am surprised that I have seen some leading voices advocating circumvention measures.
Paywalls as a concept are nothing new, and they have been used in a broad range of contexts for decades now. What is relatively newer is the choice being offered between access subject to payment on the one hand and access free-of-charge but subject to profile-based advertising on the other hand – and recently there has been a strong resurgence of discussions regarding circumvention.
To draw a parallel with copyright and digital rights management (DRM) [i.e. a situation where access/usage circumvention measures have already been discussed extensively], the approach taken by judges in the EU and elsewhere to the idea of circumvention has typically been “it’s allowed if proportionate” – and the only cases where circumvention could be lawful are cases where a legitimate user needs to circumvent the DRM in order to benefit from the legally permitted use. If you aren’t a legitimate user, DRM circumvention is prohibited.
So when might circumvention be allowed regarding “pay or data” walls etc.? I would be surprised if a higher court allows circumvention outside of cases where you already have a legitimate right to use the service or product.
But surely I’m a legitimate user?
So… are you a legitimate user if you don’t yet have a contract? As a rule, no. (The law may specifically regulate cases of “universal service”, but this is rare these days and will not apply to most businesses. And even then, laws regarding universal service have traditionally said that the service could be against remuneration or that it was subsidised for low-income users.)
“But Googlebot gets access to the content anyway, why shouldn’t I?,” you may ask. Some anti-paywall tools involve pretending to the website that your request for a webpage is being made by a search engine’s “crawler”, as some websites allow access to search engines to ensure that the paywalled articles appear in web searches. Yet no law prevents a business from blocking access to everyone except for search engines. And unless you want to argue that search bots have personality rights, you might not be able to argue that there is unfair treatment or discrimination.
But surely that paywall is illegal!
What if – in your opinion – the paywall itself is illegal and that it is offering a false choice? What if you consider that the consent being sought is not freely given? That the business should not be allowed to use profile-based advertising? Could you use such a paywall circumvention tool?
Then you are taking the law into your own hands, because unless a judge steps in to order a change of practice you have no legal authority to support your actions.
“But regulator X considers cookie walls / profile-based advertising illegal”, you may say, based on guidance from a regulator or something they said in a decision. Fine, but (i) is that an absolute and unequivocal stance, without exceptions, and (ii) does national law require the business to comply with that regulator’s position? As long as it is non-binding upon that business, there is an appeal ongoing or there are exceptions, again, you are taking the law into your own hands.
(To use a hypothetical example, a decision by a supervisory authority within the European Economic Area to ban one company from using profile-based advertising and that is subject to appeal should not be relied upon as an excuse for users across the European Union to say “it’s illegal! Burn all paywalls!” – even with respect to the company in question.)
“But privacy is a fundamental right”, you may add. Yes, as is the right to data protection in the EU Charter. But interferences with fundamental rights are permitted if they meet certain conditions – and data protection laws themselves set out the practical conditions to be met. So as long as no infringement of data protection laws is actually established (read: by an authority or a judge, in a final decision not subject to appeal), you are – once more – taking the law into your own hands.
“But contextual advertising is just as good”, you may also say. While some media have found that in their case ads selected on the basis of more limited data worked well, others do not reach the same conclusion. It depends on a business’s audience, sector, etc., so you cannot assume that it will be equivalent. This is an economic discussion that supervisory authorities are in my experience not optimally equipped to handle (aside from the question of whether they even have the authority to impose one business model over another). Once more, unless there is a court decision ordering a change, circumvention would be akin to taking the law into your own hands.
But is circumvention really a bad thing?
Is that a bad thing? Yes – depending on how you circumvent those measures you could be either in breach of the terms of use of the platform in question (don’t complain then if they start using techniques to block your access altogether) or even in violation of criminal law rules.
“But proxies are lawful, right? And it’s just like using a proxy!”, you might add. We’ll get to the first part in a bit, but let’s start with the second. Proxies are used to get around restrictions based on e.g. IP address range with a view to preventing people outside of specific regions (or from them) from accessing a service (e.g. geo-blocking). Yes, it’s a similar principle – there are terms under which a service provider chooses to make a service available, and you are using technical means to pretend that this restriction doesn’t exist. You might not like those restrictions, but they exist for a reason. Your content provider might not even have the rights to make content available in your region – so by bypassing those restrictions, just as with paywalls, you wilfully ignore the context and consequences and take the law into your own hands.
Back on the first point, while the use of proxies is often promoted in the context of freedom of expression and e.g. journalistic freedom, remember that we’re talking here about businesses and looking at whether something is allowed from the perspective of local law. And no, the use of proxies in this particular context (i.e. for the purposes of getting access to commercial products and services in a manner not authorised in principle by the business) cannot be presumed to be permitted.
Closing thoughts on an attempt to present another perspective
Obviously, I may be biased. Over the years, I have worked for several clients in the publishing or media sector, and many other providers of digital services (software providers, social media platforms etc.). I have worked a lot with key players in the consent management space as well as ad tech companies. Some clients come to me precisely to help them put in place or adjust legal frameworks linked to the business practices in question, whether locally or from a global strategic perspective.
But that’s the point – I see a lot of content on LinkedIn and elsewhere berating companies for their digital practices even in the absence of any regulatory or judicial decision (sometimes even in the absence of any formal position by a regulator). And maybe we need to remind people that there is another side to the story: businesses wish to offer different ways to get products or services, some more data-driven than others, and it is first and foremost up to them to make an assessment as to which business models can work. Users should not be advocating circumvention measures – they should be urging regulators to examine whether a practice is indeed (un)lawful and then to take action.
In fact, the highest court in the EU has never said that “pay or data” is fundamentally illegal, and the European Commission has even been paving the way for a legal framework for it for a long time. The GDPR doesn’t prohibit it either*, and some national authorities have left the door open for such a possibility as well.
[* If you read Art. 7(4) GDPR carefully, you’ll see it even makes it possible to combine consent and contract as legal grounds if you can establish necessity, for instance for cases where GDPR consent is required by law (such as some ePrivacy provisions. Probably another point that will often be debated in the context of litigation.]
So if you are a user who sees a business practice that seems unacceptable in your view, it may be worthwhile thinking about how to bring that to the right person’s attention, rather than trying out or advocating circumvention measures.
And if you are a business who would like help with such an assessment or with strengthening of your position, know that there are still many advisors ready to lend a hand.
[Disclaimer & comment guidelines: This is a presentation of a specific perspective, one that is also in line with several legal arguments that have been developed over the years, but any thoughts are welcome – let’s just keep it civil.]