ICO issues guidance on consent (to personal advertising) or pay models

Following the ever-increasing online presence of consent or pay business models, the Information Commissioner’s Office (ICO) has released its much-anticipated guidance on how organisations may assess whether their consent or pay business model are data protection compliant.

What are consent or pay models?

Consent or pay models require a data subject wishing to access an online service (or product) to either:

• Consent to their personal data being used for personalised advertising; or
• Pay a fee to avoid the personalised advertising.

If a data subject does not consent or pay the fee, they will be unable to access the online service.

Balancing with the freedom to operate

The ICO recognises that online providers are not required to provide free services and generally have the freedom to operate as they choose. However, the to operate must be balanced against the rights of the data subject under relevant data protection laws.

The ICO acknowledges that consent or pay or pay models may be consistent with data protection laws if the organisation can demonstrate that the data subject has freely given their consent to their personal data being used for personalised advertising and meets other applicable legal requirements.

The four factors for assessing freely given consent

The ICO’s guidance sets out four factors’ organisations should assess when reviewing whether consent has been freely given under its’ consent or pay model. At a high level these factors are:

1. Power imbalance – If there is an obvious power imbalance between the service provider and the data subject, the data subject is unlikely to be able to freely give its consent. Organisations will need to consider all relevant circumstances in making this decision such as its’ position in the market, whether there are alternative services available and the types of the people using the online services.
2. Appropriate fee – The fee paid by data subjects under the “pay” option should be appropriate and proportionate. A fee that is too high may make it difficult for organisations to establish the user freely provided consent. The ICO’s suggested measure for assessing whether a fee is appropriate, is, “the value that people that use or could use your product or service associate with not sharing their personal information for purposes of personalised advertising” (not the value the service or product). Organisations can still operate a pay for access model if data subjects have an option where the fee (or increase in fee) only reflects the value associated with personal information not being shared for personalised advertising.
3. Equivalency – The core service should be available both to users who “consent” and users who “pay”. The core service should also be broadly equivalent in content, functionality and quality. If the core service is not equivalent, it could be hard to establish that users had a genuine and free choice between consenting and paying.
4. Privacy by design – Organisations implementing consent or pay models should consider relevant data protection legislation from the outset and design the model to be compliant. Additionally, consent or pay models are likely amount to high-risk processing so organisations will need to undertake a data protection impact assessment before implementing such model.

Organisations using or considering “consent or pay” models should familiarise themselves with the ICO’s consent or pay guidance but remember, this guidance should not be looked at in isolation from other relevant guidance and data protection laws.

The ICO’s full guidance on consent or pay models can be found here.

If you require advice on the data protection compliance of your consent or pay model, then please contact our data protection team.