Earlier this week the ICO launched a call for views on the “pay or okay” business model. By way of recap, this model gives users of online services the choice to either consent to personalised advertising using their data or to pay a fee to access an ad-free version of the service. In its blog post launching the call for views, the ICO also provided an update on its wider cookie compliance work.

Key takeaways from the blog:

  1. In its emerging thinking on the “pay or okay” model, the ICO notes that data protection law does not prohibit the model in principle, which many organisations will find reassuring.
  1. However, it notes that care must be taken to ensure that any consent obtained for personalised advertising in the context of such a model is valid (in particular freely given, fully informed and capable of being withdrawn without detriment). As a starting point, the ICO suggests that the following will be factors that help determine whether the consent is valid:
  • Whether there is an imbalance of power between the service provider and the user – consent is unlikely to be freely given where a user has little or no choice whether to use the service or not. The market power of the service provider would be a factor;
  • Whether there is equivalence between the ad-funded service and paid-for service;
  • Whether the fee is appropriate – consent is unlikely to be freely given when the fee for an ad-free service is unreasonably high;
  • Whether the users are presented with the choices fairly and equally and understand how their personal data will be used by the service providers and others “as payment for the service they receive”. No doubt, the recommendations in the ICO and CMA’s joint paper on Harmful Design in Digital Markets will play into what the ICO will expect on how information and choices are presented; and
  • How existing users use the service – there may be a different balance in power where a service is used extensively in user’s lives (as is the case with many social media platforms).
  1. The ICO indicates that its developing views on the “pay or okay” model will be influenced by regulatory and industry developments in the UK and other jurisdictions. Among other things, they are likely to be referring to the upcoming phase-out of third party cookies by Google, the EDPB’s anticipated guidance on the “pay or okay” model and the ECJ judgment on the IAB TCF (which we will report on shortly).
  1. The ICO plans to publish updated guidance on cookies and similar technologies for consultation after the DPDI Bill receives Royal Assent later this year. This will set out its final and expanded regulatory positions on the pay or okay models. In their letter to key industry stakeholders dated 5 March 2024, they have also indicated that the updated guidance will cover the impact of the proposed changes to the cookie consent rules set out in the DPDI Bill.
  1. Buoyed by the impact that their recent cookie crackdown has had on the consent banners of the UK’s most viewed website, the ICO plans to deploy technology to assess the cookie compliance of much greater numbers of sites. It is also assessing the responses they have received from organisations that have not made the required changes to “[determine] which cases to prioritise for enforcement action”. Rather ominously, the ICO ends its blog post by saying “This is the last chance to change. Our next announcement in this space will be about enforcement action”. This should act as a warning to all companies that they cannot ignore their obligations in relation to cookie consent.

Our take

The “pay or okay” model has received significant (and often negative) attention following Meta’s introduction of the model in the EU last Autumn. Despite this, given the challenges faced by companies that rely on online advertising (especially following the 2023 Meta decision and regulatory guidance and enforcement action across Europe), “pay or okay” looks likely to be a route favoured by many companies provided that they can implement it in a compliant manner. The ICO’s efforts to help provide clarity on this is therefore very welcome, although where they will land still remains unclear.

We will continue to follow this and other developments in this area, with 2024 set to be a year of profound change for the online advertising sector.