The Information Commissioner’s Office (ICO) is examining the business practice by which customers are given a choice between accessing an online service without payment if they consent to their personal information being used for personalised advertising or, if they do not wish to consent, having to pay to access the service. It has called for views from all stakeholders to help the ICO develop its final regulatory position on this business model which will be reflected in its upcoming update on its guidance on cookies and similar technologies.

The paper usefully sets out a summary of the ICO’s current guidance and approach in this area. The law does not prohibit the ad-funded model (also known as “consent or pay”). However, consent is a valid legal basis for processing personal data only where it is freely given. This might not be the case, for example, where access to a service as a whole is denied if users do not consent to personalised ads. The ICO will consider the ad-funded business model in terms of how organisations ensure what they want to do is focused on people’s interests, rights and freedoms, whether the evidence shows that people are fully aware of what happens when they interact with an online service, and how organisations demonstrate that people are making informed, free choices. Factors to consider in assessing whether valid consent has been given in the ad-funded model context include the power balance (there may be little choice over whether to consent if, for example, the service provider has a position of market power), whether the ad-funded service and the paid-for service are equivalent, whether the fee is reasonable (consent is unlikely to be freely given if the alternative is available only at an unreasonably high fee), and whether the choices are presented to users fairly and equally. Particular attention should be given to existing users where the power imbalance may be greater, as heavy users may find it hard to switch. Further, consent will only be valid where people have been properly informed about what will happen with their personal information. Finally, the law gives users the right to withdraw their consent, and businesses must make it as easy to withdraw consent as it is to give it.

This is an area of focus within the EU as well, including by the European Commission (previously reported by Wiggin), and also comes in the context of the ICO’s ongoing programme of enforcement in respect of the use of cookies (previously reported by Wiggin).

For more information and to respond to the call, which closes on 17 April 2024, click here.