Meta’s ad-free subscription and why it was challenged
Privacy rights group, None of Your Business (NOYB), chaired by activist Max Schrems, filed a complaint against Meta with the Austrian Data Protection Authority on Tuesday 28 November 2023. The NOYB claims that Meta’s newly launched paid ad-free subscription service for Facebook and Instagram, offered to users in the European Economic Area and Switzerland, amounts to payment for privacy.
Meta’s ad-free subscription model will offer users the chance to engage on the platforms without commonly used advertisement and without behaviour tracking, which the tech giant has previously received complaints and subsequent regulatory action for. Behaviour tracking can be described as Meta’s principal advertising model which is based on building profiles using the information provided by the users to allow advertisers to steer relevant and personalised ads. In the statement released by Meta, reaffirming their commitment to ad-supported internet, the spokesperson states that the European Union (EU) users will be given a choice between using Facebook and Instagram with ads or opting for a monthly subscription with no ads.[1] On the face of it, the ad-free subscription model may seem to ease the privacy concerns over Meta’s use of personal data and behaviour tracking. However, the ad-free service cost is 9.99 euros per month for web-based users and 12.99 euros for iOS and Android users.[2] This amount is expected to rise from March 2024 by an additional cost of 6 euros per month for web-based users and 8 euros per month for iOS or Android users for the ad-free subscription to apply to each additional account the user has in their Meta Account Centre.[3] With the increase expected in March 2024, for iOS and Android users, the total amount of the ad-free subscription is expected to exceed 250 euros a year.
NOYB is concerned that such a financial cost is excessive, and consent cannot be ‘freely given’ where the alternative is such a high fee in return for user privacy.[4] As a result, NOYB complained to the Austrian Data Protection Authority on the grounds that Meta has processed user’s data without a legal basis, violating Article 6(1) of the General Data Protection Regulation (GDPR), and processed user’s data unlawfully, violating Article 5(1)(a) of the GDPR.[5]
This article will seek to analyse the law and the ECJ judgments to determine the validity of the privacy concerns over the ad-free subscription model and discuss whether NOYB’s claim to the Austrian Data Protection Authority is likely to succeed.
If we turn to the law – Is NOYB right in their claim?
Undoubtedly, consent is one of the six lawful bases under Article 6 of the GDPR to process personal data. However, consent can only be appropriately relied upon as a lawful basis to process personal data if it meets all the requirements of valid consent. Article 4(11) of the GDPR requires that valid consent must be “freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”[6]
The issue in this case is concerning the element of ‘freely given’ consent. As a principle, the GDPR and the relevant data protection authorities in the EU have clarified that where the data subject has no free choice, feels pressured to consent or will experience negative outcomes if they do not consent, a valid consent cannot be said to be present.[7] A clear example of invalid consent is where consent is included as part of a non-negotiable terms and conditions or where refusal or right to withdraw are not exercisable.[8] In this case, we can safely say that there is a right to refuse or withdraw which is defined in monetary terms. It is also not presented under the terms and conditions. In other words, we can confirm that there is a ‘choice’ presented to the Meta users – pay for ad-free or don’t pay for ad-included subscription.
However, the crucial point is determining whether this choice is made freely and whether there is a realistic alternative for the data subjects. At this point, it is helpful to turn to the EDPB’s May 2020 guideline on consent, where EDPB states that “any element of inappropriate pressure or influence upon the data subject” regardless of the form it takes, will be invalid if it obstructs data subjects’ right to exercise their free will.[9] In relation to this, the Information Commissioner’s Office (ICO) importantly clarifies the difference between incentivising and penalising the data subject. ICO states that some influence such as a benefit may arise from consenting to incentivise data subjects. However, such influence should not unfairly penalise the data subject for refusing to consent and amount to a detriment.[10] Although Meta users can utilise the platforms without consenting to ad-free subscription, users suffer a detriment in monetary terms, which is arguably far from merely incentivising the users.
As NOYB has highlighted, the excessive cost, resulting in detriment to the users, does beg the question of whether only certain groups in society can exercise their right to privacy with genuine free will. This is ever more problematic given Meta’s market dominance. Facebook users corresponds to approximately 37.5% of the world’s population with over 3 billion users and Instagram follows behind Facebook with over 2 billion active users.[11] Hence, the detriment is not only defined in monetary terms but also in terms of the unavailability of a close alternative platform where users can protect their privacy without charge.
What does the decision in Meta vs Bundeskartellamt tell us?
In response to NOYB’s claims, Meta has responded asserting that the ad-free subscription model was a valid form of consent and was in line with European Court of Justice’s (“ECJ”) judgment in Meta vs Bundeskartellamt (Case C-252/21) on 4 July 2023.[12] The decision of the ECJ advanced by Meta concerned a request for a preliminary ruling by Düsseldorf Higher Regional Court on Meta’s misuse of its market dominance and the unlawful processing of users’ data for advertising purposes without their consent. More specifically, the question for the court was to determine whether the German Federal Cartel Office (“FCO”), which is not a data protection supervisory authority, could find a violation of the EU GDPR, while investigating an abuse of a dominant position in the market.[13] In the case, the ECJ clarified the requirements of the GDPR legal bases and raised the prospect of paid subscription models subject to consent. In considering consent as a lawful basis, the Court clarified that businesses may rely on consent for such processing where consent is freely given, and the subject matter is not necessary for the performance of the contract. More importantly, the Court goes on to state that “those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations, which are not necessary for the performance of the contract, without refraining entirely from using the service”.[14]
Although the Court by taking this approach may appear to contradict the position that consent is not freely given where the only other option to consent is to pay, there are two elements that must be satisfied by the data controllers to offer a subscription model that relies on consent as the lawful basis for processing. Firstly, where an alternative subscription model is to be implemented such model must provide ‘equivalent’ level of service and not mere access to the service. Secondly, the payment for such subscription must be ‘necessary’ and ‘appropriate’. What is necessary, equivalent, or appropriate has not been clarified by the Court and this is specifically where the question will turn to decide on the validity of NOYB’s claim. Additionally, in determining the validity of consent under the GDPR, as the July case put forward, the service provider’s dominant position in the industry may be considered, but this alone will not be determinative to invalidate use of consent as a legal basis.
Taking the above into account, if we turn to NOYB’s claim what is important is determining whether the fee requested is ‘out of proportion’ as NOYB states and whether this is within or outside the scope of ‘appropriate fee’ set forth in the July judgment. According to statistics, an average person has 35 apps installed on their smart devices.[15] If all these apps followed the footsteps of Meta and adopted an ad-free subscription model, considering the fee of 12.99 euros for iOS and Android users and the additional cost of 8 euros to come into play in March 2024, this could lead to users paying 8,815 euros per year to protect their right to privacy and refrain from behavioural targeted advertising. Undeniably, as suggested by the privacy rights group, this is a shocking number to protect one’s fundamental human right – the right to privacy.[16] In complement to this argument, Max Schrems asks an interesting question – “How many people would still exercise their right to vote if they had to pay 250 euros to do so? There were times when fundamental rights were reserved for the rich. It seems Meta wants to take us back for more than a hundred years”.[17] Although the aim of the tech giant may not necessarily be to take us back for more than a hundred years, evidently Meta is committed to finding alternative routes to generate profit from advertising, despite the increasing regulatory pressure in the EU. The critical question is whether it will succeed.
Conclusion – Should Meta be concerned and what we should expect?
It is safe to state that Meta cannot hide behind the July judgment of the ECJ to validate its ad-free subscription model introduced in the EU. Instead, the onus will be on Meta to demonstrate that the consent was freely given and meets the requirements of ‘necessity’, ‘appropriate fee’ and ‘equivalent service’ and hence, is in line with the relevant provisions of the GDPR.
Although it is not easy to say what conclusion the Data Protection Authority will come to, it’s without doubt that the fee set forth by Meta will result in users making a choice not only based on their opinion on privacy and the extent of processing, but also on monetary concerns. Therefore, it could be argued that the likely impact of the cost of the subscription on users’ choice and deficit of a credible alternative service due to Meta’s market dominance, is adequate to deem the fee inappropriate. On the other hand, if Meta is successful in defending its case and arguing that subscription models constitute viable alternatives in accordance with the July judgment, the regulators will need to put a price tag on privacy and clarify what is appropriate.
It is important that the Austrian Data Protection Authority offers a well-grounded decision on this claim as there is a risk that if NOYB is unsuccessful in their claim, this will have a domino effect in the industry whereby other similar service providers may also turn to offering ad-free subscription. Wide scale adoption of ad-free subscription can result in making privacy potentially unaffordable to users, which will beg more serious questions on the efficacy of the European data protection regulation and whether fundamental right to privacy is upheld in the EU. From an administerial perspective, it is likely for the complaint to be redirected to the Irish Data Protection Authority given that Ireland is home to Meta’s European headquarters.[18] Regardless of the advising regulatory body, we will continue to watch this space to understand whether EU users of Meta will need to pay a fee to exercise their right to privacy or will Meta be subject to further regulation and challenged with another considerable fine.
[1] ‘Facebook and Instagram to Offer Subscription for No Ads in Europe’ (Meta, 30 October 2023) https://about.fb.com/news/2023/10/facebook-and-instagram-to-offer-subscription-for-no-ads-in-europe/ Accessed 7 December 2023.
[2] ibid n (1), Meta.
[3] ibid n (1), Meta.
[4]‘Noyb files GDPR complaint against Meta over “Pay or Okay”’ (noyb, 28 November 2023) https://noyb.eu/en/noyb-files-gdpr-complaint-against-meta-over-pay-or-okay Accessed 07 December 2023.
[5] ibid n (4), Noyb.
[6] Article 4(11) GDPR.
[7] Opinion 15/2011 on the definition of consent (WP187), p.12.
[8] Guidelines 05/2020 on consent under Regulation 2016/679, European Data Protection Board (EDPB), p.7.
[9] ibid n (8) EDPB Guidelines 05/2020.
[10] ‘What is valid consent?’ (Information Commissioner’s Office) https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/consent/what-is-valid-consent/ Accessed 12 December 2023.
[11] Salvador Rodriguez, ‘Instagram surpasses 2 billion monthly users while powering through a year of turmoil’ (CNBC, 14 December 2021) https://www.cnbc.com/2021/12/14/instagram-surpasses-2-billion-monthly-users.html Accessed 07 December 2023.
[12] Judgment of 4 July 2023, Meta Platforms Inc and Ors v Bundeskartellamt. C-252/21, EU:C:2023:537.
[13] ibid n (12), Meta Platforms Inc.
[14] ibid n (12), Meta Platforms Inc,paragraph 150.
[15] ‘Think with Google, Marketing Strategies’ https://www.thinkwithgoogle.com/marketing-strategies/app-and-mobile/average-number-of-apps-on-smartphones/ Accessed 7 December 2023.
[16] ‘Meta’s EU ad-free subscription faces early privacy challenge’ (Natasha Lomas, 28 November 2023) https://techcrunch.com/2023/11/28/meta-ad-free-sub-noyb-complaint/#:~:text=Meta’s%20shiny%20new%20bid%20to,meaning%20they%20will%20be%20tracked Accessed 7 December 2023.
[17] ibid n (4), Noyb.
[18] According to Article 56 of the UK GDPR, the leading supervisory authority will be the supervisory authority of the main establishment of the controller, unless the subject matter of the complaint relates only to a single establishment in one member state.
