Meta's Privacy Pivot: Pay or Give Your Data? Unveiling the “Pay for Your Rights” Dilemma
Bulut Girgin, Ceren Ceyhan, Doğa Günaydın
Meta, the parent company of Facebook and Instagram, is shifting its business model for users in the EU, EEA and Switzerland to a "Pay for Your Rights" approach. Under this strategy, users who opt not to consent to giving up their fundamental right to privacy on these platforms will be required to pay $14 per month or $168 annually to use these services.
What happened before?
This shift is Meta’s response to legal challenges and fines related to privacy violations and data processing practices.
Meta’s challenges began in 2018 with user complaints about the data-gathering practices on Facebook and Instagram. This was followed by the imposition of several administrative fines by various data protection authorities across different European Union member states.
In 2022, the European Data Protection Board (EPDB) released five binding decisions related to a complaint-based investigation centred on the legality and transparency of processing for behavioural advertising within the Facebook service. The decisions address various issues, with a primary focus on determining whether processing personal data for contract fulfilment constitutes a legitimate legal basis for behavioural advertising.
In May 2023, the Irish Data Protection Authority (DPA) conducted an investigation against Meta and imposed an administrative fine of EUR 1.2 billion after the EDPB's binding dispute resolution decision dated 13 April 2023 regarding Facebook’s service. The fine was imposed after a determination that Meta’s reliance on the performance of a contract as a legal basis for tracking and profiling users for targeted ads was not valid under the GDPR.
In July 2023, the Court of Justice of the European Union (CJEU) ruled that Meta had violated the GDPR by using "contractual necessity" as a basis for processing user data in the context of behavioural advertising. Consequently, Meta faced fines and restrictions on its data-processing activities.
Meta has continued processing the personal data of EU users without GDPR-compliant consent, even as the company works on a solution that aligns with relevant decisions and requirements. In response to this, the Norwegian DPA imposed a "ban" on Meta's data processing for three months beginning from 4 August 2023, stipulating that valid consent must be obtained for such activities.
On 27 October, in an urgent binding decision, the EDPB directed the Irish DPA to take final action against Meta within two weeks and to impose a ban on the processing of personal data for behavioural advertising on the legal bases of contract and legitimate interest across the entire European Economic Area (EEA).
What is Meta's Solution?
To address these challenges, Meta announced on 30 October 2023 that it will introduce a subscription-based, paid, ad-free version of Facebook and Instagram. According to this announcement, from November 2023, users from the EU who choose not to consent to personal data usage can opt for this ad-free version by paying $14 per month or $168 annually. The ad-supported free version continues to be available for users who do consent. As Meta officially announced the forthcoming release of these new plan options in November, it is now in practice for European users.
This new model introduces a significant shift in the platform market. Users now have three options: pay for the ad-free version, use the ad-supported free version by consenting, or explore competing platforms.
Unpacking the domino effect
As Meta rolls out its “Pay for Your Rights” model, a series of critical questions come to the forefront. While Meta emphasises user choice, the affordability aspect becomes a significant concern, especially for those who cannot afford the subscription fee. In this situation, individuals unable to pay for the ad-free version may reluctantly give up their fundamental right to privacy, posing a challenge to the concept of freely given consent, a fundamental aspect of the GDPR.
In this respect, the Austrian privacy group NOYB announced that they lodged a complaint on 28 November 2023 with the DPA of Austria (Datenschutzbehörde) asserting that Meta's new model infringes data privacy laws. NOYB argues that consent was not considered "freely given" if the only alternative is to make a payment, citing concerns over this aspect of Meta's approach.
Adding to the complexity, Meta's approach explicitly assigns a value to users' personal data—this value is determined solely by the platform. Furthermore, the potential domino effect of other platforms adopting similar models would become increasingly evident, raising concerns about the affordability of online privacy for countless users.
In conclusion, Meta's “Pay for Your Rights” model presents a challenging approach to privacy concerns. The complex dynamics involving affordability, fundamental rights, and data value raises critical questions about the future landscape of data privacy, particularly regarding user consent and the broader economic impact on individuals. As this new paradigm takes shape, it has the potential to reshape how major tech entities handle user privacy, establishing a precedent for the future of online services.