European websites achieve "North Korean consent rates" through payment barriers

Pay-or-okay systems across European websites achieve consent rates of 99.9% despite academic research showing only 0.16% to 7% of users genuinely want personalized advertising. According to noyb, the privacy advocacy organization that released comprehensive findings on July 24, 2025, these models create what researchers describe as "North Korean consent rates" while providing minimal economic benefit to news publishers.

The 47-page report examines how companies present users with binary choices: accept tracking for free access or pay subscription fees to refuse consent. Meta implemented similar models for Facebook and Instagram in October 2023, while news publishers across Austria, Germany, France, Italy, and Spain adopted the approach starting in 2018.

Research reveals the economic arguments supporting pay-or-okay systems contain significant distortions. Digital advertising accounts for approximately 10% of European press revenue, with programmatic advertising requiring personal data representing only 5% of total newspaper and magazine income. Academic studies show publishers earn €0.24 per user monthly from tracking, while pay options generate €3.24 per user monthly.

The cost analysis demonstrates substantial consumer burden relative to advertising revenue. French users pay approximately 800% of total digital advertising revenue per user when refusing consent on single websites. German users face €1,528.87 annually for rejecting consent across 29 top-100 websites implementing pay-or-okay models.

Industry representatives defend these systems as providing genuine user choice. According to the report, Dirk Freitag, CEO of Content Pass, stated in interviews that consent rates increase from 65-85% with traditional banners to 99% with pay-or-okay systems, enabling publishers to "make a lot more money from advertising."

The European Data Protection Board addressed pay-or-okay concerns in Opinion 08/2024, determining most implementations fail to meet GDPR standards for freely given consent. The opinion emphasized platforms should offer genuinely free alternatives without behavioral advertising rather than defaulting to paid rejection options.

Legal challenges continue mounting across jurisdictions. Hamburg Administrative Court received noyb's lawsuit against the local data protection authority in August 2024 for approving DER SPIEGEL's consent practices. Privacy advocates argue these systems violate GDPR Article 6(1)(a) requirements that consent be "freely given" with "genuine or free choice."

The technical implementation creates substantial friction differences between consent options. Accepting tracking typically requires single clicks, while refusing consent involves account creation, payment processing, and subscription management. This disparity contradicts EDPB guidance requiring equal effort for both consent and rejection choices.

Revenue projections suggest pay-or-okay models cannot rescue struggling news industries. According to the analysis, implementing these systems would increase overall press income by merely 0.82% when considering only 5% of revenue derives from programmatic advertising. Press revenues declined 19.3% between 2016 and 2021, making pay-or-okay benefits statistically insignificant.

Several variations exist across implementations. Some publishers combine pay-or-okay with "freemium" approaches, creating double paywalls where basic content requires consent decisions while premium content demands additional subscriptions. Other systems offer completely ad-free experiences versus non-personalized advertising alternatives.

Cross-site services like Content Pass and Freechoice attempt bundling multiple websites under single subscription models. These approaches face criticism for offering geographically disparate or topically unrelated website combinations that fail to match realistic user consumption patterns.

Meta's October 2023 implementation pricing set European benchmarks at €9.99 monthly for web access and €12.99 for mobile applications. The company subsequently challenged EDPB Opinion 08/2024 through General Court litigation filed June 27, 2024.

Technical limitations further undermine pay-or-okay effectiveness. Browser implementations like Safari and Firefox block third-party cookies by default, while ad-blocking software usage reaches 44 million users for uBlock Origin alone. Only 30% of internet users remain trackable through current advertising technology, limiting revenue potential regardless of consent rates.

The enforcement landscape varies significantly across European jurisdictions. French authorities have ordered corrections to misleading cookie banners, while German data protection authorities face litigation for delayed responses to pay-or-okay complaints filed in August 2021.

Individual compensation claims are emerging through civil courts. Leipzig District Court awarded €5,000 to a Facebook user in July 2025 for Business Tools violations, establishing precedent for private enforcement mechanisms supplementing regulatory oversight.

Market consolidation concerns arise from implementation patterns. Six major consent management platform providers control approximately 95% of European market share, enabling rapid pay-or-okay adoption across thousands of websites if regulatory approval occurs.

The report concludes pay-or-okay systems primarily serve subscription promotion and consent rate manipulation rather than genuine service funding. Only 0.1% of users typically choose payment options, while 99.9% accept tracking despite research indicating minimal genuine preference for personalized advertising.

Data protection authorities face pressure to develop consistent enforcement approaches as pay-or-okay spreads beyond news publishers to broader online services. The upcoming EDPB guidelines will likely determine whether these models can achieve GDPR compliance or require fundamental restructuring.

Timeline

• 2018: Austrian newspaper Der Standard introduces first pay-or-okay system
• August 2021: noyb files complaints against German data protection authorities over t-online.de and faz.net consent practices
• October 2023: Meta announces subscription model for ad-free Facebook and Instagram access at €9.99-€12.99 monthly
• April 17, 2024: EDPB adopts Opinion 08/2024 finding most consent-or-pay models violate GDPR standards
• June 27, 2024: Meta challenges EDPB opinion through General Court litigation
• August 1, 2024: noyb sues Hamburg DPA over approval of DER SPIEGEL consent practices
• January 26, 2025: UK ICO allows consent-or-pay models with strict compliance requirements
• June 17, 2025: noyb files lawsuits against German authorities over four-year enforcement delays
• July 24, 2025: noyb releases comprehensive pay-or-okay report documenting 99.9% consent rates

Key Terms Explained

Pay-or-okay Models: Digital consent systems presenting users with binary choices between accepting data tracking for free service access or paying subscription fees to refuse consent. These models emerged in European news publishing around 2018 and expanded to major platforms like Meta's Facebook and Instagram by 2023. The term encompasses various implementations including standalone payment options, bundled subscriptions, and freemium combinations where users face multiple payment barriers across different content tiers.

GDPR Consent Requirements: The General Data Protection Regulation mandates that user consent be "freely given, specific, informed and unambiguous" under Article 6(1)(a). This legal framework requires genuine user choice without coercion, detriment, or conditionality that might influence decision-making. Pay-or-okay systems face scrutiny under these standards because payment requirements may constitute improper pressure that invalidates the voluntary nature of consent decisions.

Consent Rates: Statistical measurements of user acceptance versus rejection when presented with tracking permission requests. Traditional cookie banners achieve 65-85% acceptance rates, while pay-or-okay systems consistently generate 99-99.9% consent rates. This dramatic disparity between user preferences and actual consent behavior forms the central legal and ethical challenge to pay-or-okay model validity under European data protection law.

Programmatic Advertising: Automated digital advertising systems that use personal data for real-time bidding and targeted ad placement. This technology represents approximately half of all digital display advertising and requires extensive user data collection for effective operation. The economic arguments for pay-or-okay models often center on preserving programmatic advertising revenue, though this represents only 5% of total news publisher income according to industry analysis.

European Data Protection Board (EDPB): The independent European authority responsible for ensuring consistent GDPR application across EU member states. The EDPB issued Opinion 08/2024 determining that most pay-or-okay models fail to meet legal consent standards and recommending that platforms offer genuinely free alternatives without behavioral advertising. Their guidance significantly influences how data protection authorities evaluate consent system compliance.

Data Minimization: The GDPR principle requiring organizations to process only personal data that is adequate, relevant, and limited to what is necessary for specified purposes. Recent Court of Justice rulings have emphasized this principle applies regardless of legal basis, potentially limiting how companies like Meta can utilize extensive data pools for advertising even when users provide consent. This concept challenges long-term data retention practices common in digital advertising.

Legitimate Interest: An alternative legal basis for data processing under GDPR Article 6(1)(f) that allows processing without explicit consent when organizations have compelling legitimate reasons and user interests don't override these purposes. Many websites attempt to use legitimate interest for advertising tracking, though regulatory guidance increasingly restricts this approach, pushing more organizations toward consent-based models or payment alternatives.

Tracking Technologies: Technical methods including cookies, pixels, device fingerprinting, and mobile advertising identifiers used to monitor user behavior across websites and applications. These technologies enable personalized advertising, measurement, and attribution but require user permission under European privacy laws. The effectiveness of pay-or-okay models depends on maintaining access to these tracking capabilities while users increasingly adopt blocking technologies.

Revenue Attribution: The process of calculating how much income derives from specific data processing activities like personalized advertising. Industry analysis suggests publishers earn approximately €0.24 per user monthly from tracking-based advertising, while pay-or-okay subscriptions generate €3.24 per user monthly from the small percentage who choose payment options. Understanding these revenue dynamics helps evaluate whether economic justifications for pay-or-okay systems reflect genuine business necessity.

Administrative Enforcement: The regulatory oversight process where data protection authorities investigate complaints, issue decisions, and impose corrective measures or fines for GDPR violations. Several European authorities face criticism for delayed responses to pay-or-okay complaints, with some cases remaining unresolved for nearly four years. This enforcement gap has prompted privacy advocates to pursue direct court challenges against regulatory inaction while individual users seek compensation through civil litigation.

Summary

Who: Privacy advocacy organization noyb released analysis of pay-or-okay consent systems used by European news publishers and Meta platforms, with research led by data protection lawyers examining industry practices across multiple jurisdictions.

What: Pay-or-okay models achieving 99.9% user consent rates despite studies showing only 0.16%-7% genuine preference for personalized advertising, with systems requiring payment to refuse tracking while generating minimal revenue increases of 0.82% for news publishers.

When: Report published July 24, 2025, analyzing systems implemented since 2018 by Austrian newspaper Der Standard and adopted by Meta in October 2023, amid ongoing legal challenges and regulatory review.

Where: European Union countries including Austria, Germany, France, Italy, and Spain, with particular focus on news publisher implementations and Meta's Facebook and Instagram platforms across EU, EEA, and Switzerland.

Why: Systems allegedly manipulate consent rates to increase advertising revenue while circumventing GDPR requirements for "freely given" consent through excessive payment barriers, creating what researchers term "North Korean consent rates" incompatible with genuine user choice.