Platforms should not confront users with 'binary choice' over personal data use
The EU's Data Protection Board (EDPB) has told large online platforms they should not offer users a binary choice between paying for a service and consenting to their personal data being used to provide targeted advertising.
In October last year, the social media giant said it would be possible to pay Meta to stop Instagram or Facebook feeds of personalized ads and prevent it from using personal data for marketing for users in the EU, EEA, or Switzerland. Meta then announced a subscription model of €9.99/month on the web or €12.99/month on iOS and Android for users who did not want their personal data used for targeted advertising.
At the time, Felix Mikolasch, data protection lawyer at noyb, said: "EU law requires that consent is the genuine free will of the user. Contrary to this law, Meta charges a 'privacy fee' of up to €250 per year if anyone dares to exercise their fundamental right to data protection."
I’m all for GDPR and really enjoy its protections, but I don’t understand this one. If facebook says they need €10/mo to provide their services and gives us the choice to either pay that or to pay with targeted ads, then how does that infringe upon our data [Edit: integrity autonomy]? The service seems to be worth something, so the EU cannot expect facebook to just give it out for less, can they? What’s the basis for this?
They can just charge €10/mo like every other company does, for example Netflix. They can't offer it as an alternative to the "freely given consent". It's not freely given if the alternative is to pay to not give this consent.
The biggest problem with this approach is basically Facebook saying that you have to pay for a right, meaning, if the law tells you that you can, and should, always have a say if you are followed around or not, you mist have that capability. What Facebook is doing is put a right behind a paywall, which is absurd
If I understand you correctly, you’re making the same argument as [email protected]above, so I’ll copy answer to them here:
That is a completely different issue. On the one hand, meta does collect data on people who do not have an account. This is simply illegal, since that collection is neither necessary nor consented to. The EU should finally put a stop to that.
On the other hand we have the voluntary relationship a user enters with facebook by creating an account. This is what the article is about and what I was referring to in my comment – the “binary choice between paying for a service and consenting to their personal data being used to provide targeted advertising”
Are there any rights you think should supersede contracts? If so, how do you draw the line between rights that do and don’t?
(I’ll answer your question in a comment side-chain, just because you asked.)
Germans have the right to continued wage payments if they need to take care of family members (§616 BGB). However, that right can be voided in the employment contract.
(§618 BGB) essentially states that the work environment must be reasonably safe. This cannot be voided by contract, as is codified in (§619 BGB).
These are just instances. I do not know any general rules for the precedence of contracts over the law or vice versa.
I’m not sure which meaning of ‘should be able to be voided’ you’re using. Do you mean ‘Why do think it’s legal to void it’ or ‘Why do you think it’s legitimate to be able to void it’?
In the first case: My employment contract does exactly this. It’s become kind of a default clause in contracts. Researching this you’ll find a lot of websites (in German) that say that the clause is ‘abdingbar’ (which I translated as ‘voidable’).
In the second case: I didn’t say I thought it legitimate, and I don’t have a strong opinion on this.
Are there any rights you think should supersede contracts?
That is beside the point I’m making. Facebook acknowledges the right to privacy by giving you the choice to pay for the service rather than giving up your data. In my view, this should be completely acceptable by the GDPR. No-one is forcing you to sign up to facebook, so you do have a completely free choice to (1) either not give up your data and not use facebook; or (2) not give up your data and pay for the service; or (3) give up your data and pay for the service that way.
Firstly, this is not "my argument", this is EU's argument.
Secondly, none of these platforms present it as a choice between paying and giving the kind of consent that by law needs to be optional and freely given.
Thirdly, being free to not use a service that is breaking the law does not make it any less illegal.
I can’t find the word ‘unbiased’ in the GDPR. All it asks for is consent:
Processing shall be lawful only if and to the extent that at least one of the following applies:
a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes;
In the case of facebook, the user gives consent for the purpose of being served targeted advertising in exchange for the provided service.
[Edit:] Found something:
When assessing whether consent is freely given, utmost account shall be taken of whether, […] the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Article 7, paragraph 4 GDPR
So the question of whether the pay-or-consent model is legal hinges upon the question of whether payment (in any form) is “necessary for the performance of that contract“.
Yes the term is "freely given consent" indeed, but more importantly: Why would you not trust the EU Data Protection Board if they say themselves that consent-or-pay is not okay?
On the other hand we have the voluntary relationship a user enters with facebook by creating an account. This is what the article is about and what I was referring to in my comment – the “binary choice between paying for a service and consenting to their personal data being used to provide targeted advertising”
On the one hand, meta does collect data on people who do not have an account.
This is simply illegal, since that collection is neither necessary nor
consented to. The EU should finally put a stop to that.
Good that you brought that up. And that deserves more attention!
I didn't read the massive thread, no idea if the correct answer is already in there, but there seems to be a lot of text and the answer is realy short.:
This does not prohibit them from using Ads to finance the service.
It just prohibits data collection.
Those two things are not the same.
Privacy is a fundamental human right. It’s not a luxury or a means to extort or monetize customers. That’s why the EU is getting involved. Because companies like Meta will leverage them against monetization.
It’s like going to your doctor and having them tell you that unless you pay them $50 for the visit, they’ll sell your medical data to whomever.
A company has to build their services on top of privacy and security, not use either as a means to monetize or boost profits. That’s what the EU is fighting for. Because we all know what happens when it’s left up to the companies…
Just wondering, do you know that reading the article where it's all explained in detail is an option?
Before the change 3% of facebook users agreed to be tracked, after "pay or be tracked" suddenly that jumped to over 90%. The entire point of GDPR is that privacy is a really hard thing to grasp, and that companies have capabilities most people can't even imagine. So the GDPR demands consent to be given freely. Giving users the choice between yet another subscription or "consent" is clearly not free consent, your "free consent" doesn't jump from 3% to 90% if you're not basically coercing your users.
"yeah, but they have the option to pay". Yeah, and then i can start paying for google (each service seperately with complex bundles of course), and facebook, and reddit, and twitter and tiktok and .... and of course everyone has hundreds of dollars to spend on online services to continue using the internet the way we've been using it for a decade.
"yeah, but you could use other services", yeah, i could go to a facebook alternative where none of my friends or family are. Or a youtube alternative where hardly anyone posts videos or... These sites have gained a natural monopoly by being free, and now suddenly i have to pay to not have my rights violated.
And will this long term mean sites like facebook, youtube, ... become unprofitable and collapse? I for sure hope so yes. These companies gained a monopoly in big parts of the internet, and will make insane profits of being in that position either via ads or subscriptions. This is a terrible place for society to be in, and the sooner they collapse, the sooner we as society can start figuring out what would be a model that does work and isn't hostile to its user.