Consent or pay may be okay: new ICO guidance

The UK Information Commissioner’s Office (ICO) has published its consent or pay guidance. This largely reflects the ICO’s initial position in its call for views last year (see our previous blog).

By way of reminder, consent or pay models involve customers being presented with three options – either consenting to advertising cookies to drive personalised ads while accessing a product or service, paying to access the product or service to avoid personalised ads, or walking away. 

Consent or pay models are distinct from "take it or leave it" models, which the ICO has confirmed are most likely not compliant because they do not offer users a genuine free choice.

Crucially, the ICO guidance does not conclude that all consent or pay models are non-compliant. The guidance centres around whether consent is “freely given” (as required by the General Data Protection Regulation) when it’s an alternative to payment and provides further detail on the four criteria businesses should consider (as referenced in its call for views last year).

ICO Assessment Criteria

Power imbalance

Organisations should consider whether there is a power imbalance between the organisation and the individual. The ICO states that this is more likely where an organisation is in a dominant market position and it may work with the Competition Markets Authority on questions around this. 

In addition, the ICO considers that a power imbalance between the organisation and the individual may be more likely if people using or relying on the product or service are in a vulnerable position, for instance due to their age, disability or financial situation. This echoes the focus on vulnerability in the recent judgment against Sky Betting and Gaming (see our previous blog) and poses a challenge to businesses who have broad user-bases that may touch on some (if not all) of these categories.

If there is a power imbalance, organisations should take additional steps to ensure people have a meaningful choice. The ICO suggests that this could include introducing an additional fee option involving contextual rather than personalised advertising or improving users’ ability to transfer their data to an alternative product or service.

Appropriate fee

Organisations should ensure the fee is at an appropriate level so that the data subject has a real choice.

The ICO confirmed it’s not its job to set an appropriate fee but says the most important factor for organisations to consider is the value consumers attribute to avoiding their personal data being processed for personalised advertising. The ICO acknowledges this is not straightforward to assess. It will therefore be interesting to see whether a market standard emerges on this. 

Equivalence

Organisations should offer a core product or service which is essentially the same across both options. Thus, those choosing to pay rather than consent should not be penalised by the nature or standard of the product or service they receive. If an organisation wants to offer a premium product, e.g. with access to additional content, the price for that premium product must be separate to the “appropriate fee”.

Privacy by design

Organisations must comply with their privacy by design obligations, many of which overlap with those in the cookies guidance (so organisations should look to both).

As an example, organisations must clearly explain to users what the options mean – the ICO states that language such as “continue to read for free” or “subscribe for all content” does not achieve this.  

EU position

The ICO’s guidance follows that from other data protection authorities on consent or pay models, such as those in France, Germany, and Austria (on the latter, see more here) . Last year, the European Data Protection Board (EDPB) also adopted an Opinion on these models offered by large online platforms. This concluded that in the context of such platforms it will not be possible, in most cases, to obtain freely given consent if the only choice is to consent or pay.

The EDPB is expected to publish guidelines of more general application on consent or pay models later this year. 

Outlook

The new guidance comes as the ICO announces its 2025 plan to give users more control over information used to deliver personalised ads online. Organisations who have adopted (or are considering adopting) consent or pay models should review their models against the criteria detailed in the guidance (as well as the new cookies guidance) and document their model’s compliance accordingly. 

Some in the industry have criticised the guidance as being too vague in places, but to be fair to the ICO, it is often better for organisations for this to be the case than for the ICO to be overly prescriptive.