EU Court dismisses Meta’s challenge to EDPB’s ‘consent or pay’ opinion
Central to the EDPB’s analysis was Article 4(11) GDPR, which defines consent as ‘freely given, specific, informed, and unambiguous.’
The General Court of the European Union has dismissed Meta Platforms Ireland Ltd’s legal challenge against the European Data Protection Board’s (EDPB) Opinion 08/2024 on ‘consent or pay’ models. The Court ruled the action as, in part, inadmissible and, in part, manifestly lacking any foundation in law.
Background on EDPB opinion 08/2024
The EDPB identified three primary flaws in existing implementations:
- Absence of a genuine choice
- Disproportionate data collection
- Socioeconomic discrimination
Issued on 17 April 2024, the EDPB’s Opinion 08/2024 addresses the validity of consent under the General Data Protection Regulation (GDPR) in the context of ‘consent or pay’ models implemented by large online platforms. These models typically offer users a binary choice: consent to the processing of personal data for behavioural advertising or pay a fee to access the service without such processing.
The EDPB concluded that, in most cases, such models do not meet the GDPR’s requirements for valid consent. Specifically, the EDPB emphasised that consent must be freely given, and presenting users with a choice between consenting to data processing or paying a fee may not constitute a genuine choice, especially when the service is significant for social or professional participation. The EDPB recommended that large online platforms offer an equivalent alternative that does not involve behavioural advertising and does not require payment, to ensure compliance with GDPR standards.
Meta’s legal challenge
On 27 June 2024, Meta filed an action for annulment against the EDPB’s Opinion 08/2024 at the General Court of the European Union. Meta presented several pleas in law, arguing that the EDPB’s opinion infringed upon fundamental rights and principles, including the Charter of Fundamental Rights of the European Union. Meta contended that the opinion introduced obligations not found in the GDPR, violated principles of legal certainty, and constituted an illegal and disproportionate interference with its freedom to conduct a business.
For more detailed information, you can access the full text of the EDPB’s Opinion 08/2024 here: European Data Protection Board.
