Meta challenges EDPB's opinion on 'Consent or Pay' model

On June 27, 2024, Meta Platforms Ireland Ltd filed a lawsuit against the European Data Protection Board (EDPB) at the General Court of the European Union. The action challenges the EDPB's Opinion 08/2024, which addresses the validity of consent in the context of 'consent or pay' models implemented by large online platforms.

The legal battle stems from a series of events that unfolded over the past year.

On October 30, 2023, Meta announced its plan to offer users in the European Union, European Economic Area, and Switzerland the option to pay a monthly subscription for ad-free access to Facebook and Instagram.

The subscription model was set to launch in November 2023, with pricing at €9.99 per month for web access and €12.99 per month for iOS and Android users.

On April 17, 2024, the EDPB adopted Opinion 08/2024, which provided guidance on the validity of consent in 'consent or pay' models implemented by large online platforms. The EDPB determined that most 'consent or pay' models do not comply with General Data Protection Regulation (GDPR) standards for valid consent.

On June 27, 2024, Meta Platforms Ireland Ltd filed an action for annulment against the EDPB's Opinion 08/2024 at the General Court of the European Union.

The action was published in the Official Journal of the European Union on August 12, 2024.

The lawsuit filed by Meta presents seven pleas in law, challenging various aspects of the EDPB's opinion. These pleas touch on fundamental issues of EU law, data protection, and the balance of powers within the European Union.

The first plea alleges that Article 64(2) of the General Data Protection Regulation (GDPR) is either illegal and inapplicable or requires a restrictive interpretation in line with established EU legal principles. Meta argues that the EDPB's interpretation and application of this article violate fundamental rights enshrined in the Charter of Fundamental Rights of the European Union and disturb the balance of powers established by EU treaties.

In its second plea, Meta contends that the EDPB's opinion violates Article 19(1) of the Treaty on European Union by failing to respect the binding nature of judgments from the Court of Justice of the European Union (CJEU). Specifically, Meta claims that the opinion misinterprets the CJEU's judgment in Case C-252/21, which involved Meta Platforms and others.

The third plea argues that the EDPB's opinion constitutes an illegal and disproportionate interference with Article 16 of the Charter, which protects the freedom to conduct a business. Meta asserts that the opinion fails to strike a fair balance between conflicting fundamental rights.

In its fourth plea, Meta alleges a violation of the principle of equal treatment, as enshrined in Article 20 of the Charter. This suggests that Meta believes the opinion unfairly targets or affects certain types of businesses or platforms.

The fifth plea is particularly significant, as it accuses the EDPB of introducing a novel and incoherent obligation that is not present in the GDPR. Meta argues that this violates Article 52(1) of the Charter, the principle of legal certainty, the notion of consent as defined in Article 4(11) of the GDPR, and the principle of data minimization outlined in Article 5(1)(c) of the GDPR.

The sixth and seventh pleas focus on procedural aspects. Meta claims that the EDPB failed to act as an impartial body, violating Article 41(1) of the Charter. Additionally, Meta alleges that its right to be heard, as protected by Article 41(2)(a) of the Charter, was violated during the opinion-forming process.

The case brings to light the complex interplay between data protection regulations, fundamental rights, and the business models of large online platforms. At its core, the dispute centers on the concept of 'consent or pay' models, where users are given the choice between consenting to data processing for advertising purposes or paying for an ad-free experience.

The EDPB's opinion, which Meta is challenging, provides guidance on when such models can be considered to involve valid consent under the GDPR. The board emphasizes that consent must be freely given, specific, informed, and unambiguous. It also highlights the importance of offering genuine choice to users and avoiding situations where there is a clear imbalance of power between the platform and the user.

One of the key points of contention appears to be the EDPB's suggestion that platforms should consider offering a free alternative without behavioral advertising, in addition to the paid ad-free option. This recommendation, which the EDPB views as enhancing user choice and autonomy, seems to be at odds with Meta's business strategy and interpretation of EU law.

The case raises important questions about the balance between data protection, user rights, and the economic interests of online platforms. It also highlights the ongoing challenges in interpreting and applying the GDPR in the context of evolving digital business models.

As the case proceeds through the General Court, it will be closely watched by data protection authorities, online platforms, and privacy advocates alike. The outcome could have significant implications for how 'consent or pay' models are implemented across the EU and may influence the future development of data protection regulations.

Key facts

• Meta Platforms Ireland Ltd filed a lawsuit against the EDPB on June 27, 2024
• The action challenges EDPB Opinion 08/2024 on 'consent or pay' models
• Meta announced its subscription model for ad-free access on October 30, 2023
• The EDPB adopted Opinion 08/2024 on April 17, 2024
• The lawsuit presents seven pleas in law against the EDPB's opinion
• The case was published in the Official Journal of the EU on August 12, 2024
• The dispute centers on the validity of consent in 'consent or pay' models
• Key issues include fundamental rights, data protection, and business freedom
• The outcome may significantly impact online platforms' data practices in the EU