The striking flaws and logical gaps inside the EDPB consent or pay opinion

*Lots* to be said about the EDPB’s Opinion 08/2024 on “Consent or Pay”. One thing that strikes me throughout the document is the insistence on a “Free Alternative Without Behavioural Advertising” (= contextual ads).

[Edit: full analysis now live: https://lnkd.in/eddQ4yW8 ]

The reasoning goes like this:
– if you are a “large online platform”, the EDPB suggests there will be an imbalance of power, which according to the EDPB makes consent flawed under the GDPR
– to rectify this, you need to ensure there are no “adverse consequences at all” to not giving consent
– one possibility is to offer an alternative without “negative impact”, which *could* be the “Free Alternative Without Behavioural Advertising

[Nothing in the Opinion about the commercial implications of that alternative or why it might or might not be an appropriate form of advertising on e.g. a social media network. Nothing either about the fact that third-party data might not at all be a source in the context of ads on some social media networks.]

But then:

(i) What if the platform wishes to include attribution, anti-fraud measures and frequency capping and – based on the EDPB’s comments at the IAPP Congress in Brussels in November 2023 – consent is then required anyway under the EDPB’s interpretation of Art. 5(3) of the ePrivacy Directive? Is that a “Free Alternative” that meets the EDPB’s requirement to have no “adverse consequences at all”, given that there is a choice between “pay or consent or consent”? Would the EDPB then say that it isn’t sufficient and a further “Free Alternative” is required?
[Or can we finally ditch the EDPB’s idea that these measures require consent?]

(ii) What if the platform *doesn’t* wish to include frequency capping, creating a higher likelihood of the same ad appearing constantly? Isn’t that a negative impact for the user, because the user experience is more irritating?

(iii) What if the platform *doesn’t* include attribution or anti-fraud measures? Wouldn’t that necessarily lead to *more* ads having to appear on the same page, to compensate for the fact that a large part of the ads might not be shown to actual users? Isn’t that a negative impact for the user, because the content is less visible?

I will be preparing an in-depth critique of the Opinion, but it might already be good to hear from EDPB members why in their view none of these situations would be seen as creating a negative impact for the user and not having any “adverse consequences at all”.

[Edit: full analysis now live: https://lnkd.in/eddQ4yW8 ]

data protection