noyb and the Norwegian Consumer Council today filed a joint complaint against Schibsted with Norway's data protection authority, alleging that the publisher's practice of charging readers a monthly fee to opt out of personalised ad tracking violates the GDPR's requirement for freely given consent.

The Norwegian Consumer Council (Forbrukerradet) and the European privacy organisation noyb today filed a formal GDPR complaint against Schibsted, one of the largest media companies in the Nordic region, over its implementation of a pay-or-okay consent model across its Norwegian publications. The complaint was submitted to the Norwegian Data Protection Authority, known as Datatilsynet, and requests both a declaration that the practice is illegal and the imposition of a fine.

Schibsted publishes some of the most widely read news outlets in Norway and Sweden. Its portfolio includes Aftenposten, VG, Bergens Tidende, Aftonbladet, and the television channel TV4. The company's reach across the region means its consent practices affect millions of readers and carry significant weight for how personalised advertisingconsent is negotiated across Scandinavian digital media.

What the pay-or-okay model requires

The mechanics of the model are straightforward. When a reader visits a Schibsted publication, they are presented with a binary choice: consent to having their personal data processed for personalised advertising, or pay a fee to access the content without being tracked. There is no third option - no way to decline tracking without paying. According to noyb, that structure is precisely what makes the system incompatible with GDPR rules.

The GDPR requires that consent be freely given. Under Article 7 of the regulation, consent cannot be considered free if compliance with a contract - or in this case, access to a service - is made conditional on agreeing to the processing of personal data that is not necessary for that service. Personalised advertising tracking is not necessary to deliver a news article. It is a commercial activity that benefits the publisher. Tying access to it, or charging for its absence, is what noyb and the Norwegian Consumer Council argue transforms consent into coercion.

According to noyb, consent rates under pay-or-okay systems consistently reach approximately 99 percent. That figure is striking when set against what research shows about genuine preferences. Various independent studies indicate that only between 0.16 percent and 7 percent of people actually want to be tracked or have their personal data used for personalised advertising. The gap between what people say when facing a financial penalty and what they want when given a genuine choice is, according to noyb, the clearest evidence that consent obtained under these conditions is not freely given in any meaningful sense.

Schibsted itself has acknowledged the dynamic. According to the complaint documentation, Fredric Karen, Schibsted Sweden's Executive Vice President, stated in an interview with the Swedish public broadcaster SVT that "studies show that if you allow this [to reject consent] without demanding any form of payment in return, a great many users will decline." That admission, made publicly by a senior company executive, forms part of the factual record that noyb and the Norwegian Consumer Council are placing before Datatilsynet.

Max Schrems, honorary chairman of noyb, described the situation in pointed terms: "The use of 'Pay or Okay' leads to a consent rate beyond 99%, despite the fact that only a small number of people wants to be tracked online. In reality, 'Pay or Okay' leads to nothing but a North Korean consent rate."

Finn Myrstad, Director of digital policy at the Norwegian Consumer Council, framed the issue in terms of fundamental rights: "Privacy is a fundamental right - not a premium option. This is about more than ads for shoes or football gear. This type of tracking makes it possible to build highly detailed profiles of us: how we think, behave, and can be influenced when we are at our most vulnerable."

Joakim Soderberg, a data protection lawyer at noyb, added: "Profiteering from fundamental rights is not a legitimate business model in Europe. We're hoping that the Norwegian DPA sees things our way, and that Schibsted abandons this unpopular and unlawful scheme."

How Schibsted's rollout spread across the Nordics

The current complaint is not the first sign of regulatory friction around Schibsted's consent practices. Until 2026, pay-or-okay models had remained relatively rare in the Nordic countries, with the exception of a handful of Danish websites. That changed in March 2026, when Schibsted's Swedish subsidiary introduced the system across all of its websites, including Aftonbladet and the TV guide. The rollout covered major publishing properties and triggered an immediate public response.

According to noyb, the Swedish data protection authority IMY had already received at least 56 individual complaints against Schibsted following the Swedish launch. That volume of complaints - from a single country, within weeks - indicates the depth of public concern the practice has generated in markets where it had not previously been common.

Norway was the next step. Schibsted extended its pay-or-okay system to its Norwegian publications, where it owns some of the country's most prominent outlets. As PPC Land reported on May 1, 2026, Datatilsynet had already published a critical statement on April 30, 2026, responding to the introduction of a 39-Norwegian-kroner monthly fee charged to subscribers of Aftenposten, VG, and Bergens Tidende who declined personalised advertising. That fee - roughly equivalent to three to four euros per month - applied solely as a condition for withholding consent, and not in exchange for any enhanced level of service.

Datatilsynet's April 30 statement had stopped short of a formal enforcement decision, but it raised concerns that the model may not meet the GDPR standard for freely given consent, that it risks making data protection financially inaccessible for lower-income users, and that it could create particular pressure on children, young people, and other vulnerable groups. The joint complaint filed by noyb and the Norwegian Consumer Council today takes the matter further, requesting a formal legal assessment and a fine.

A practice with German roots and European reach

The pay-or-okay model did not originate in Norway. According to noyb, it was first introduced by news media companies in German-speaking countries and subsequently spread across the continent. Meta adopted a version of it for Instagram and Facebook in 2023, charging European users a monthly subscription fee if they wished to use the platforms without targeted advertising. That move generated extensive regulatory attention and litigation. The European Data Protection Board issued a non-binding Opinion 08/2024 in April 2024, finding that in most cases consent-or-pay models do not constitute valid consent under the GDPR. That opinion was requested by the Norwegian, Dutch, and Hamburg data protection authorities - a point that makes its relevance to the Schibsted case in Norway particularly direct.

German publishers have faced years of complaints and minimal enforcement. As PPC Land documented in June 2025, noyb filed lawsuits against data protection authorities in North Rhine-Westphalia and Hesse after nearly four years of inaction on complaints against faz.net and t-online.de. Both sites had implemented pay-or-okay consent banners in 2021. The North Rhine-Westphalia authority ultimately issued what noyb described as a non-decision in May 2025, stating it could not yet reach a conclusion after approximately four years of deliberation.

Austria has moved further. An Austrian court ruled in August 2025 that the pay-or-okay implementation used by DerStandard, Austria's leading liberal newspaper, violated GDPR requirements. DerStandard had required users to either consent to tracking by hundreds of third parties or purchase a monthly subscription priced at 9.90 euros. The court upheld an earlier decision by the Austrian Data Protection Authority.

The spread of the practice beyond its German-speaking origins into Scandinavia follows a pattern PPC Land analysed in July 2025, which documented how pay-or-okay systems achieve consent rates of 99 to 99.9 percent across European publishers - a finding that noyb and its legal partners argue is itself evidence of systemic coercion rather than genuine preference.

Understanding why these consent rates matter requires understanding what the GDPR actually demands. The regulation does not simply require that users click a button. It requires that the consent be freely given - meaning the user must have a genuine alternative. When the alternative is a financial charge, the quality of the consent changes. The GDPR's recitals make explicit that consent is not freely given when there is a clear imbalance of power or when refusal results in detriment to the data subject.

The 99 percent consent rate under pay-or-okay systems, contrasted with the 0.16 to 7 percent of people who studies show actually want personalised advertising, is the central statistical argument in noyb's complaints. The gap is not explained by a change in preferences. It is explained by a change in the price of refusal.

noyb also points to the commercial reality: the EDPB's 2025 Annual Report, published in April 2026, recorded 1.14 billion euros in total GDPR fines across Europe during 2025. That figure reflects an enforcement environment that has grown substantially more active, even if inconsistently applied across member states.

The complaint against Schibsted sits within a broader set of actions noyb has pursued. The organisation has filed approximately 800 cases in total against companies including Google, Apple, Facebook, and Amazon. It secured EU-wide authority to bring collective redress actions, with approvals from the Austrian Federal Cartel Attorney in December 2024 and the Irish Ministry of Justice in October 2024. That authority, granted under Directive (EU) 2020/1828, could be relevant to future proceedings if Schibsted's practice is found illegal and damages are sought on behalf of affected readers.

What the complaint asks Datatilsynet to do

According to noyb, the complaint requests two specific actions from the Norwegian Data Protection Authority. First, it asks Datatilsynet to assess the legality of the pay-or-okay model and declare it illegal. Second, given what noyb describes as a systemic practice employed by Schibsted across multiple publications and markets, the complaint requests that the authority issue a fine.

The reference to systemic practice is legally significant. Under GDPR Article 83, fines can reach up to 4 percent of a company's total annual global turnover for violations of the consent requirements in Article 7. Schibsted's revenues across its Nordic operations are substantial. Any fine calculated on that basis would be meaningful, though the actual amount would rest with Datatilsynet.

The Norwegian authority had already signalled concern in its April 30 statement. Whether that concern translates into a formal infringement decision remains to be seen. The Norwegian process will be followed closely, particularly in Sweden, where Schibsted's involvement in other media industry disputes - including initiating the exclusion case against Meta at IAB Sweden - has placed the company at the centre of several parallel regulatory and industry governance stories this year.

For digital advertising professionals, the outcome of this complaint carries implications that extend beyond Schibsted. Publishers across Europe that have adopted pay-or-okay models are watching Norwegian enforcement closely. If Datatilsynet issues a finding of illegality, it will increase pressure on data protection authorities in other countries to act on existing complaints rather than delay. It will also narrow the space available to publishers who have treated the EDPB's April 2024 opinion as a warning rather than as a binding rule - which it technically is not, though national authorities are expected to apply it.

Timeline

  • 2021 - noyb files GDPR complaints against German publishers faz.net and t-online.de over pay-or-okay consent systems
  • October 2023 - Meta introduces a subscription model for ad-free Facebook and Instagram access in Europe, priced at 9.99 to 12.99 euros per month
  • April 17, 2024 - The EDPB adopts Opinion 08/2024, finding that most consent-or-pay models do not constitute valid GDPR consent; the opinion was requested by Norwegian, Dutch, and Hamburg data protection authorities (PPC Land)
  • August 1, 2024 - noyb files a lawsuit against the Hamburg Data Protection Authority over its approval of DER SPIEGEL's pay-or-okay system (PPC Land)
  • September 1, 2024 - Meta challenges the EDPB's Opinion 08/2024 at the General Court of the EU (PPC Land)
  • December 2, 2024 - The Austrian Federal Cartel Attorney grants noyb formal authority to bring collective redress actions EU-wide (PPC Land)
  • January 26, 2025 - The UK Information Commissioner's Office publishes guidance allowing consent-or-pay models for publishers under certain conditions (PPC Land)
  • June 17, 2025 - noyb files lawsuits against data protection authorities in North Rhine-Westphalia and Hesse over four years of inaction on pay-or-okay complaints (PPC Land)
  • July 27, 2025 - PPC Land publishes analysis of pay-or-okay consent rates across European publishers, documenting the 99 to 99.9 percent acceptance rates under financial pressure (PPC Land)
  • August 19, 2025 - An Austrian court upholds a ruling that DerStandard's 9.90-euro monthly subscription fee as a condition for refusing tracking violates the GDPR (PPC Land)
  • March 2026 - Schibsted's Swedish subsidiary introduces pay-or-okay across all its websites, including Aftonbladet, triggering at least 56 complaints to the Swedish IMY
  • March 11-12, 2026 - IAB Sweden votes to expel Meta from membership; Schibsted was among the publishers that initiated the exclusion case (PPC Land)
  • April 9, 2026 - EDPB publishes its 2025 Annual Report, recording 1.14 billion euros in total GDPR fines across Europe during 2025 (PPC Land)
  • April 30, 2026 - Datatilsynet publishes a statement criticising Schibsted's 39-krone monthly privacy fee applied to Norwegian subscribers of Aftenposten, VG, and Bergens Tidende (PPC Land)
  • June 3, 2026 - noyb and the Norwegian Consumer Council file a joint GDPR complaint against Schibsted with Datatilsynet, requesting a declaration of illegality and a fine

Summary

Who: noyb (European Centre for Digital Rights) and the Norwegian Consumer Council (Forbrukerradet) filed the complaint. Schibsted, the Norwegian media group that owns Aftenposten, VG, Bergens Tidende, Aftonbladet, and TV4, is the subject. Datatilsynet, Norway's data protection authority, is the receiving body. Named individuals include Finn Myrstad, Director of digital policy at the Norwegian Consumer Council; Max Schrems, honorary chairman of noyb; Joakim Soderberg, data protection lawyer at noyb; and Fredric Karen, Schibsted Sweden's Executive Vice President.

What: A formal GDPR complaint alleging that Schibsted's pay-or-okay consent model - which charges readers 39 Norwegian kroner per month to decline personalised ad tracking - does not meet the GDPR standard for freely given consent. The complaint requests a declaration that the practice is illegal and asks Datatilsynet to issue a fine, citing the systemic nature of the scheme across Schibsted's Nordic portfolio.

When: The complaint was filed on June 3, 2026. Schibsted introduced the model in Sweden in March 2026 and subsequently extended it to Norway. Datatilsynet published a critical statement on April 30, 2026. The underlying regulatory framework - EDPB Opinion 08/2024 - was adopted on April 17, 2024.

Where: The complaint was filed with Datatilsynet in Norway. Schibsted's pay-or-okay practices span Norway and Sweden, affecting publications in both countries. The broader regulatory context involves data protection authorities across Germany, Austria, and the European Union.

Why: noyb and the Norwegian Consumer Council argue that conditioning access to a free service on payment for the exercise of a fundamental right - the right not to be tracked without genuine consent - contradicts Articles 6 and 7 of the GDPR. Industry data showing consent rates of approximately 99 percent under pay-or-okay systems, against studies indicating that only 0.16 to 7 percent of users genuinely want personalised advertising, forms the core of the legal argument. The complaint also highlights a public statement from Schibsted's own executive acknowledging that users would widely reject tracking if no payment were required, which noyb presents as an admission that the consent obtained is not freely given.