Skip to content 
Opinion IAB Europe responds to criticisms of the use of ‘consent or pay’ models and argues that publishers must be entitled to determine their own business models.
Do “consent or pay” models implemented by online publishers force users to make an “impossible choice” between access to content on the one hand and the protection of their fundamental right to privacy on the other?
Is consent-or-pay even illegal under the EU’s flagship data protection law, GDPR, as well as UK law that derives from it?
Or so some observers of an increasingly lively debate on the topic suggest.
Consent or pay: Can you put a price on privacy?
Misunderstandings
But their perspective reflects a basic misunderstanding of GDPR and ignores economic reality as well as, ultimately, the interests of European citizens.
The central aim of GDPR is to guarantee the right to the protection of personal data that is laid down in Article 8 of the Charter of Fundamental Rights of the European Union.
GDPR is not a caveat emptor (“let the buyer beware”) legal regime that leaves citizens to determine for themselves which processing may violate their fundamental rights or entail unacceptable risk, and which processing is safe.
Instead, it places the burden of responsibility for compliance on the companies that process personal data. These companies must establish a legal basis for processing, implement appropriate safeguards and render a broad range of user rights. Failure to do so can mean sanctions of up to 4% of global annual turnover in case of infringements.
Assuming effective enforcement, there are no unsafe choices.
Moreover, critics falsely posit a hierarchy in fundamental rights in which privacy trumps all other rights. In fact, GDPR is also intended to facilitate the free movement of data and the protection of other fundamental rights and freedoms, including the freedom to conduct a business that is also guaranteed by the charter.
The freedom to conduct a business means publishers must be entitled to determine their own business models — to decide for themselves whether they wish to rely on subscription-only, subscription and advertising, or some other model.
And what about business realities?
Quite apart from the legal position, two important business realities need to inform how we approach the consent-or-pay debate.
The first is that advertisers, like anyone else investing money, want to limit the risk that their investments are wasted by putting ads in front of people who are not interested in what they are selling. This is particularly true of new, disruptor brands that have lower budgets and need to turn over every pound or euro twice before spending it.
Personalised advertising based on observed behaviour across sites and over time provides the best chance for smaller sites and apps (and even large traditional publishers) to achieve the scale required to flourish alongside the data-rich, vertically integrated platforms.
One often hears the claim that contextual advertising works just as well, but with less processing of personal data.
A simple example illustrates why this is not the case for all sites and apps, notably news media: no commercially valuable information about interest or intent can be gleaned from the fact that a user read an article about the Russian invasion of Ukraine or the Donald Trump administration’s tariff policy. Advertisers will make investment decisions accordingly.
The second reality is that valuable online content, whether in the form of news or entertainment, or B2B products and services, must be financed.
The internet is not a parallel universe where products and services of value can be conjured up without investment; news that costs nothing to produce will be worth nothing.
User subscription can and does finance a massive amount of online value, but users benefit from being able to finance their consumption indirectly by being willing to receive advertising, with all the data subject rights and data controller obligations laid down in EU and UK law.
Very few users can afford to subscribe to everything; strong legal protections mean that it is not necessary to.
Don’t mix up free consent and free content
The ”freely given consent” laid down in GDPR was never intended to mean “freely given content” — not for users and not for producers of high-quality online content like The Media Leader.
Rather than pretending that the normal rules of economics do not apply to the internet, the best way to support publishers and their readers is with effective enforcement of Europe’s flagship data protection regulation.
This includes more awareness-raising of how the law enhances, rather than undermines, fundamental rights.
Townsend Feehan is CEO of IAB Europe
