New battle lines may be being drawn in the European Union between Facebook and Instagram owner Meta and the rights of regional users to privacy.

So far, the tech giant is publishing unlawful ads in the EU because they are tracking users and profiling their behavior without a proper legal basis. The ruling comes after this summer when the bloc's top court ruled that it cannot invoke legitimate interest for processing personal data like this; and in January, a major decision by privacy regulators determined the company can also not claim contractual necessity.

That leaves consent. And consent under the bloc's General Data Protection Regulation (GDPR) has to be informed, specific, and freely given. However freely given hasn't always been interpreted to mean free, as in gratis—thanks to a push by certain news publishers to put up content paywalls that ask users to subscribe to their journalism or accept tracking ads.

Meta is playing its familiar game of positioning itself as the global go-to choice for publishers and platforms-as Facebook-manoeuvring toward adopting the same approach that squeezed its surveillance business model past regulators the first time, allowing it to continue to track and profile users in the EU unless they pay it for their privacy.

The Wall Street Journal reported yesterday that the ad tech giant is in talks with the bloc's data protection regulators to roll out the ad-free subscription version of its service in the region. Users who do not want to pay a fee of $14 or even $17 per month to access Meta apps Facebook and Instagram, would have to accept its so-called "personalized ads", aka Meta's tracking and profiling of their online activity, if they want to access its social networking services.

Meta spokesman, Matt Pollard refused to confirm or deny the WSJ report. But his e-mail pointed to what was couched as "additional context" — in the form of a paragraph of the recent Court of Justice of the EU judgment in which the court suggests users who refuse to consent to data processing should not have to refrain from using the service entirely but should be provided with "an equivalent alternative not accompanied by such data processing operations"… "if necessary for an appropriate fee". So at least Meta is raising the issue that it may end up charging.

In an emailed statement it also added that it is continuing to "explore options" — writing:

Meta believes in the value of free services which are supported by personalized ads. However we continue to explore options to ensure we comply with evolving regulatory requirements. We have nothing further to share at this time.

A blog post Meta released this summer, when the company announced an "intent" to transition to consent for its tracking ads, did not mention anything about charging a fee. It did note, though: "Once this change is in place, advertisers will still be able to run personalised advertising campaigns to reach potential customers and grow their businesses."

Would paying Meta $14 a month not to snoop on you meet the GDPR's standard of freely given consent? Not literally, certainly. Nor does it obviously respect the spirit of the EU's fundamental rights framework, which doesn't dole out protections based on people's ability to pay.

But would a pay-to-play choice--paying a fee for access to information or paying with your privacy--violate the rules? Courts will likely have to weigh in on interpretation of the GDPR standard for consent given freely.

Any such move by Meta would likely face novel legal challenge, as privacy rights advocacy group noyb — which has already racked up a series of major GDPR strikes against Meta — confirmed today. Indeed, noyb has been pushing back against news publishers' "pay or okay" approach since 2021, filing a string of complaints with data protection authorities. So it has a head start on challenging any similar pay-for-your-privacy tactic by Meta.

"Fundamental rights cannot be for sale," said noyb's founder and honorary chairman, Max Schrems, in a statement today. "Are we going to pay for the right to vote or for free speech next? This would mean that only the rich can enjoy these rights, at a time when many people are struggling to make ends meet.". That is a major shift in introducing this idea in the area of your right to data protection, he said. "We would fight this up and down the courts," he said.

The exchange continued with an orbiter dictum — in this case, the CJEU paragraph floating the possibility of an "appropriate fee" — going on to describe the suggestion a Big Tech giant like Meta could charge a fee for tracking ad-free access as "very alarming". "We would move towards 'pay for your rights'," he warned.

"The CJEU said the alternative to advertising should be 'necessary' and the fee should be 'appropriate'. I don't think €160 per year is what they had in mind," he added in noyb's press release. "These six words are also an 'orbiter dictum, or a non-binding annexation beyond the centre case before the CJEU". For Meta this is not the most stable case law and we will clearly fight against such an approach".

While data protection authorities have been willing to let news publishers afford users a choice of "subscribe or be tracked", they are commercial entities that do (at least) produce journalism - with all the cost that work entails. In comparison, Meta would just be putting a paywall around user generated content (UGC) that was freely uploaded to its platform. It's therefore interesting to consider what an "appropriate" or indeed "necessary" fee might mean in Meta's context.

All content up for free upload sounds pretty cheap to me. And given Meta gets content from its users for free, why must it charge anything at all? It's not exactly like the service of Spotify premium (circa $11 per month for individuals), where the streaming giant has to pay to license the songs it delivers ad-free to subscribers.

Meta floating the idea of charging $14pm—or even $4—looks like a bad joke.

And besides, there is no prohibition on Meta implementing other types of advertising that don't require processing user data. Such as contextual advertising.

So if the company actually means to implement a binary choice between an ad-free subscription and tracking-and-profiling-based ad-targeting, it is framing a false choice in the interests of maintaining a privacy-hostile surveillance business model. (And, well, you'd think EU judges would be on to such an obviously bad-faith play as this, as they have been to earlier Meta GDPR circumventions. Though it might take a couple of years before a case would get referred up to the CJEU).

The 'pay or okay' approach was first developed by Austrian newspaper, Der Standard, which asked users either to agree to the processing of personal data for advertising or fork out a fee of €8.90 a month-up to €107 a year-for access to its journalism ad-free, also notably a lower fee than the charge Meta is reported to have suggested.

Other DPAs in Germany and France then agreed with the approach as a way of showing preference to journalism. The irony today is that Meta seems poised to take up this news publisher carve-out — but not itself be in the journalism business. And when Meta and the other adtech giants are accused of vacuuming up ad revenues that once paid for news. The possibility that Big Tech would seize on a CJEU ruling to continue raking in profits at the expense of users would be bleak enough. ("We see that regulators have allowed 'Pay or Okay' models to support journalism in times when advertising revenue was sucked up by Google, Meta and the like. Now this loophole is used by Big Tech," as Schrems notes.)

More recently, though, TikTok has also been seen testing an ad-free subscription version of its service, which could indicate it's starting to look at things on a similar basis to Meta. In the EU, the company's attempt to move from relying on consent as a lawful basis for its tracking-ads processing to rely on legitimate interest was blocked following an intervention by a regulatory body last year.

Meta and TikTok have the DPC of Ireland as their lead supervisor in terms of GDPR. The DPC told us it's not in a position to comment on the situation regarding the meta legal basis at the moment.

For several months now, since the CJEU ruling, the DPC — like other EU DPAs — has been meeting with Meta to review its compliance in light of the decision issued by the court. We are aware that this process is ongoing. No public timeline has been announced regarding Meta's promised future shift to consent.

In parallel, Norway's data protection authority issued its own local prohibition on Meta's tracking ads this summer. It recently also referred the matter to the European Data Protection Board asking it to take a binding decision.
A spokesman for Norway's authority told TechCrunch that it is very concerned about reports Meta is considering asking people to consent to be tracked or else to pay for it.

The CJEU judgment basically said, that pay or okay might be acceptable, depending on the case. However, simultaneously the CJEU was clear in saying that the freedom of choice of users depends on whether there exists a power imbalance. That is the crucial point here," he said.

"Meta owns the biggest social media platforms, so finding an alternative, alternative service will be difficult for users. It is mainly because of so-called network effects when users will want to be exactly where "everyone" is — and in this case, "everyone" is on Facebook and Instagram.". Also, Meta have offered their services for free for most of the last two decades, and many people invested heavily their digital lives into these services. To a great number of users it can be said safely that Facebook and Instagram became the obligatory informational and relational infrastructure.

For many, using Facebook or Instagram is second nature. That alone indicates an imbalance of power. Then to have Meta suddenly turn on users and tell them "pay or lose your privacy" certainly puts the user in a very unenviable position, at least those who could not afford to add an extra charge to their monthly ration of money". If these plans materialize, we are worried sick that data protection will become a right reserved for the wealthy," said one. "Of course, we have to wait and see what happens, but we are very concerned," added the spokesman, specifying that EU data protection authorities continue to "monitor and exchange on this issue.".

Meta has so far managed to keep running "targeted ads" in the region that transgress EU law — that's why Norway's Data Protection Agency took emergency measures to impose a national ban (though Meta is ignoring its ruling and is threatened with fines of ~$100,000 a day for not complying with its order to stop serving its GDPR-violating ads, aka, just another price of playing in the surveillance economy).

Another factor here is what the European Commission will be doing.

It's the only enforcer for the EU's newly applied Digital Markets Act (DMA) – an ex ante competition regulation that strives to place up-front obligations on the most powerful platforms with the view of levelling the competitive playing field online and supporting open and contestable markets. Meta was officially designated a gatekeeper last month.

One of several requirements this pan-EU regulation imposes on gatekeepers is that those platforms which directly collect personal data for advertising from third party websites and apps (like Meta does) must enable users to "freely choose to opt-in to such data processing and sign-in practices by offering a less personalised but equivalent alternative, and without making the use of the core platform service or certain functionalities thereof conditional upon the end user's consent".

And, it prescribes that "not giving consent should not be more difficult than giving consent"; and states that "consent shall be given by a clear affirmative action or statement establishing a freely given, specific, informed and unequivocal indication of the user's wishes, as defined in Regulation (EU) 2016/679 [aka, the GDPR]".

But whether the Commission would find it acceptable for a subscriber needing to open an account to subscribe to Meta, pay through the nose for an ongoing monthly fee to the tech giant, was as onerous as hitting the "accept tracking ads" button that lets Meta keep torching their privacy is a rather pertinent question to think about.

The DMA is the flagship competition reform for the bloc. When it comes to reining in platform power, as its executive (and the law's proposer) the Commission will surely have been hoping the regulation delivers the kind of quick wins against Big Tech that have proved impossible under classic antitrust procedures, which demands painstaking after-the-fact investigation prior to any enforcement.

If Meta has managed to turn an existing EU regulation against a shiny new one in the pursuit of blocking reform of its privacy-hostile business model, that will be a double failure for the bloc's regulators. Having to wait years for CJEU clarification of interpretation of a passing remark in GDPR litigation over the quality of consent can't have been what the Commission had in mind for its flagship antitrust reform.

We have contacted the EU's competition unit to ask if it has any concern over reports that Meta is looking to shift to a model of charging regional users a fee for avoiding being tracked and profiled in light of the obligations applied to gatekeepers like Meta under the DMA.
Commission spokesman declined commenting on business decisions of companies that were designated as gatekeepers under the DMA.

"Companies designated as gatekeepers have six months to come up with concrete solutions to guarantee full compliance with the DMA until 7 March 2024. The Commission is holding discussions with the designated gatekeepers on compliance by the designated companies with the DMA," the Commission spokesperson said. "It is for the designated companies to show that they are actually in compliance.". For this reason, it is expected of them to submit a comprehensive report elaborating on how they comply with every obligation of the DMA by 7 March 2024.

Commenting on the assessment, Miranda Cole, an antitrust and competition partner in Brussels at Norton Rose Fulbright said to TechCrunch: "Meta is probably referring to the ECJ judgment's reference to "an appropriate fee" being 'imposed if necessary' for a service that does not track users". Of course, the question is how much is 'appropriate', remembering that demand for such a subscription service, versus a tracking service, will be heavily dependent on how much it costs. As with app store transaction fees, the European Commission will have to take a view as to whether it is 'appropriate' to set fees at levels which preserve what might be viewed as extracting monopoly rents.