"Consent or pay"- ICO opens a call for views and publishes initial guidance

The ICO has opened a public consultation on data protection as it relates to online business models under which access to a website is on a “consent or pay” basis. Such mechanisms give individuals the choice either to provide their personal data for personalised advertising reasons in exchange for receiving services for free or pay to access the services if they do not.

The ICO’s views on “consent or pay” are in their infancy, and it has launched a public consultation into its regulatory proposals for the business model, which is open for responses until Wednesday 17 April 2024. The consultation will inform the ICO’s more settled view on “consent or pay” access models, which it will set out in its forthcoming guidance on cookies and similar technologies.

In the meantime, the ICO has published its initial views and guidance on “consent or pay” access models, which you can read here. The guidance is expressly stated to represent the ICO’s “emerging thinking” and the ICO makes clear that organisations should not interpret the guidance to mean that by following it they will have complied with data protection law.

Those caveats aside, the ICO has concluded that, in principle, “consent or pay” models are not prohibited by data protection laws. However, those using the model should ensure that consent for processing is freely given and fully informed and that it can be withdrawn without detriment.

Additionally, in considering whether to use “consent or pay” models, the ICO suggests that organisations take account of a range of factors to determine whether consent for personalised advertisements has been validly given, including the non-exhaustive list summarised below:

• Whether there is an obvious imbalance of power between the individual and service provider. Where the service provider has a dominant market position or the individual is trying to access a public service, this may create a power imbalance with the effect the individual cannot freely give consent;
• Whether there is sufficient equivalence between the services provided to paying and consenting service users;
• Whether the fee charged to paying service users is so high as to make it an unattractive choice with the effect that consent for personalised advertisements is not freely given; and
• Whether service users have been given clear information about the “consent” and “pay” options.

Existing service users will need to be separately considered from an imbalance of power perspective, especially where they use the services in question heavily in their day to day lives.

Additionally, in order to ensure that consent is validly given, organisations will need, amongst other things, to inform individuals about how each individual’s personal information will be used and to give individuals the right to withdraw consent.

Any organisations considering adopting a “consent or pay” model for individuals to access that organisation’s services may wish to take part in the public consultation. They will certainly want to keep an eye out for the outcome of both the ICO’s call for views as well as the opinion that the European Data Protection Board is set to publish on the topic.