Hello, I'm Megan Ward and I'm joined by Flick Fisher. In today's bite-size legal update,

we're going to discuss the European Data Protection Board's guidance on the validity of a data

subject's consent given in the context of a consent or pay model implemented by large online platforms.

The headline is the EDPB said that in most cases, it will not be possible for large online platforms to demonstrate that they have obtained valid consent under the GDPR to process and end-user's data for behavioural advertising. The EDPB emphasised that consent or pay models should offer users real choice

and not just a binary option between consenting to data processing for behavioural advertising

or paying fee for the service.

So we'll start off with what is a consent or pay model.

A consent or pay model in the behavioural advertising context is where a platform or service offers users a choice between free access to the platform or service if they consent to the use of their data for behavioural advertising and paying fee for a version of the service without behavioural advertising.

The EDPB focuses on the models in which the option relates to the processing of personal data for behavioural advertising purposes.

So targeted ads and where the relevant controller is a large online platform.

So Flick, can you give us some background to this guidance?

Yeah, sure. So the debate really stems from MetETA's move to charge for ad-free Facebook

and Instagram services in the EU, following a ban that was imposed on them last year on META's

targeted advertising practices in Europe. META had basically been taken through the courts.

Last year, we had a CJAU decision which basically

confirmed that META couldn't rely on performance of a contract, which is something it had

been trying to rely on for its targeted advertising practices. And off the back of it, it therefore

had to pivot and come up with a new business model to kind of justify or attempt to justify and allow

its targeted advertising practices in Europe, hence why we got the consent or pay model that

they proposed. And off the back of that, in January last year, the European Data Protection

Board received a request from the Dutch, Norwegian and German data protection authorities,

really seeking to provide clarity on the legality of the consent or pay model.

...