The Information Commissioner’s Office (ICO) has issued a call for views on how it may regulate the “consent or pay” model of data tracking on platforms.

The ICO says it is working on ways to clarify to the online advertising industry the methods in which they can employ advertising – or third-party – cookies in compliance with data protection law.

Focusing on “consent or pay” as a mechanism is likely due to its recent deployment across the EU by Meta in response to a major GDPR ruling prohibiting Facebook and Instagram from using third-party cookies without explicit consent from users.

Meta rolled out a subscription service to EU users, offering the option of a monthly fee for an ad-free experience where their data won’t be tracked, packaged, and sold to the highest bidder for behavioral advertisements. Otherwise, users could continue to use the website for free, paying only with unmitigated access to their personal data by third-party advertisers Meta deals with.

The policy is already being lambasted with lawsuits in Europe while the UK’s data watchdog catches up and reveals its somewhat neutral stance on the controversial concept.

In their call to views, the ICO says that pay or consent models are not explicitly prohibited by current data protection laws, but that organisations should be “careful” in how they consider the model to “ensure that consent to processing of personal information for personalised advertising has been freely given and is fully informed, as well as capable of being withdrawn without detriment.”

The key word does not appear to be ‘free’, however, if companies can charge users who do not give their consent to data processing. In other contexts, this is typically referred to as coercion.

The ICO does say that organisations need to consider if there is a power imbalance, for instance if the service is essential or if the platform has market dominance.

Further, organisations need to ensure that the fee is appropriate, that there are equivalent services for each ‘consent’ option, and that the choices are presented fairly and equally.

The proposed regulatory approach also calls for the ability for people to withdraw consent without detriment – which under consent or pay, may not be possible as a fee could be classified as a detriment to the user.

Recommended reading

• Meta’s Pay-or-Consent Model Under GDPR Fire
• Meta’s “Pay for Privacy” System Getting Pushback in EU
• Data Privacy Day: Where are We and How Did We Get Here?

While the EU gears up to consider the legality of consent or pay under their GDPR, the UK is left with a lacklustre and tepid approach to new data model that monumentally alters users’ awareness of how personalised advertising and data tracking functions across the internet.

Platforms and websites that have been free to use for millions of users could now present users with two different price tags: one monetary, and one for their personal data.

Is the new regulatory model exposing the ugly truth of the internet: there’s no such thing as a free lunch, so is there no such thing as a free social platform? What price will consumers be willing to pay, and will they be forced to pay it to protect their personalised data?

Further, the UK’s data laws are set to change – the Data Protection and Digital Information Bill is set to replace the UK’s GDPR. One of the most controversial stipulations in the bill includes the ability for the Secretary of State – an appointed government official – to override guidance and decisions made by the ICO, an independent regulator.

This rises only further concerns on who will protect consumer and user data rights as the UK pushes for more business-friendly legislation.