It was a cold Parisian day in 1948 when privacy became a recognized human right. As our lives become increasingly digital, new laws have emerged around the world to put a stop to the restless abuse of our data online. Now, in the worst capitalist dystopian nightmare, the concept of privacy as a commodity has taken a sinister turn – alas, the privacy paywall.
The so-called ‘Pay or Consent’ or ‘Pay or OK’ model has made its first steps in some news publications in the EU, with Meta being the most controversial case. Companies are pushing the boundaries of the GDPR’s provisions on user consent. It goes without saying that legal challenges have stormed the attempt to define what is considered ‘privacy for the rich’. The social media giant has even suspended its new plan for no-pay ads for the European market.
Just when we thought we had won the battle, the privacy paywall landed in the UK. Access to free news from some of the UK’s most popular newspapers online now comes at a price. It’s up to you to decide whether to pay with your money or your data to get what should already be yours – your right to privacy. Not exactly “freely given consent”, is it?
The GDPR issue
The European bloc’s GDPR was a landmark for online data protection. It was the first law in the world to set clear rules for how online services should handle the trail of information people share online. Many countries have since adopted their own versions.
The law’s foundation is to minimize data collection—and what regulators define as “user consent” is central to that goal. By now, you’ve probably learned to hate all those pop-up windows that open every time you visit a website. While it can be daunting at times, here’s how you can decide to reclaim your right to privacy.
The Pay or Consent model does indeed give you a choice – on paper at least. It is certainly not a free choice. The big elephant in the room here is that under the GDPR, users must give “voluntary consent” to have their data collected.
Let’s take a look at what the AVG Guidelines say exactly. In Section 3.1, the law clearly states that “if the data subject has no genuine choice, feels coerced into giving consent, or will suffer negative consequences if he/she does not give consent, then consent is not valid.”
Similarly, Section 3.1.2 states: “In order to allow consent to be freely given, access to services and functionalities must not be made conditional on a user’s consent to store information, or to gain access to information already stored, in a user’s terminal equipment (so-called cookie walls).”
I’m not a lawyer, but it seems to me and other experts in Europe (see the video above where Max Schrems, lawyer and founder of Austrian digital rights group Noyb, discusses the issue) that ‘Pay or consent’ may be in breach of GDPR rules.
After the UK left the EU, the government enacted its own version of the GDPR. However, the “freely given consent” clause was supposed to remain. In March 2023, regulators passed another law to combat so-called pop-up fatigue. The Data Protection and Digital Information Act (DPDI) expanded the range of exemptions to the consent requirement for cookies and other web trackers – a move that was not exactly welcomed by privacy advocates.
A slippery slope
I’ve started tracking the spread of the privacy paywall plague in the UK – and I have to say it’s not encouraging. At the time of writing, some of the most widely read publications are testing the waters.
These include The Sun and Daily Mail Online, which count 24.7 and 23.2 million monthly visitors The Independent, Mirror and Daily Express are other titles that are trying to profit from their readers’ data. However, the price tag for your privacy ranges from as little as £1.99 a month to as much as £4.99 (The Sun).
The Daily Mail and co. are probably hoping to make as much money as possible until regulators realise what’s happening and understand whether or not they can regulate. More online services are likely to join if no one pushes the stop button – and even the best VPN apps can’t help us.
The examples coming out of mainland Europe are not encouraging either. In an unexpected twist, Meta demands damages from the European Data Protection Board for naming the company in a footnote to its opinion against ‘Pay or OK.’
Worse still, the Data Protection Authority in Hamburg, which ensures that consumers’ privacy rights are respected, has been accused because he allegedly actively encouraged Der Spiegel and another media company to switch to a ‘Pay or Consent’ model.
I get it, news organizations are looking for ways to generate additional revenue now that most readers are no longer paying to consume their work. However, I still believe that specifically charging to prevent online tracking is a blatant erosion of privacy, especially since the premium subscriptions that some of these titles offer are offered separately.
Think about how much money you would have to spend to surf the web if all online services implemented “Pay or Permit.” The sad truth is that the vast majority of people have no choice but to accept being tracked.
However, privacy is not a commodity, but a fundamental human right – period.