The European Union is taking a closer look at Meta’s controversial 'pay or be tracked' consent model and paywall for users. Today, the bloc issued a formal request for information under the Digital Services Act (DSA) to Meta, the owner of Facebook and Instagram, to provide more details on its Subscription for no Ads options available to users in the region.
“In particular, Meta should provide additional information on the measures it has taken to comply with its obligations concerning Facebook and Instagram’s advertising practices, recommender systems and risk assessments related to the introduction of that subscription option,”
the European Commission stated in a press release.
Meta was reached for comment on the Commission’s RFI, but their spokesperson, Matthew Pollard, stated that they have no comment at the moment.
The controversial switch to the "consent or pay" model was made by Meta last fall, after facing challenges to their previous legal basis for processing user data for ad targeting. The ad-free subscription option offered to EU users requires them to either pay a monthly fee (starting at €9.99/month) for an ad-free experience, or to agree to be tracked and profiled for targeted advertising. The latter option is problematic as under EU data protection law, consent must be informed, specific, and freely given in order to be valid. However, users in the EU currently have no way of accessing Facebook or Instagram for free without being tracked.
Privacy and consumer rights groups were quick to criticize this consent or pay model, and multiple complaints were filed under EU data and consumer protection laws. Breaching these laws could result in fines of up to 4% of global annual turnover. (See: here, here, here, and here.)
Now, the EU itself is taking action with a formal RFI under the DSA, the bloc’s recently updated ecommerce rulebook. This regulation applies algorithmic accountability and transparency rules to larger online platforms, including Facebook and Instagram, as of last August.
The DSA is highly relevant in this case as it states that larger platforms must obtain valid consent from users for advertising purposes. This consent must comply with the EU’s data protection rules and must be just as easy to withdraw as it is to provide. This regulation also prohibits the use of sensitive data and minors’ data for advertising, which raises questions about how Meta prevents sensitive data from being used in their ad targeting and how they prevent minors from accessing their platforms. The latter issue is especially important as minors are not able to purchase the ad-free subscription, leaving them no choice but to agree to being tracked, which goes against the DSA.
Although complaints against Meta for their consent or pay model are currently addressed by the Irish Data Protection Commission (DPC), which oversees their compliance with the General Data Protection Regulation (GDPR), a decision on the legality of this model has not yet been reached. This is where the European Commission comes in as they are responsible for enforcing the DSA, which has additional rules for larger online platforms. Violating these can lead to fines of up to 6% of global annual turnover.
In the first six months of enforcing the DSA, the EU has sent out multiple RFIs to platforms, including previous requests to Meta regarding topics such as disinformation, child protection, and election security. They have also opened two formal investigations on other platforms. However, the topic of advertising consent has not been a priority until now.
Last November, MEPs Kim Van Sparrentak and Paul Tang submitted written questions to the European Commission, seeking their opinion on the legality of Meta’s consent or pay offer under EU data protection and DSA regulations. They pointed out alternatives for tracking, such as contextual advertising, are available and feasible.
In response, the European Commission stated that personalized advertising must comply with the GDPR and that they are currently monitoring and assessing the DSA compliance of larger platforms, including Facebook and Instagram. However, they did not provide a clear answer. Last month, the MEPs criticized the Internal Market Commissioner, Thierry Breton, for inadequate answers and requested a clear verdict on Meta’s model. These questions were tagged as “priority questions,” increasing pressure on the European Commission to respond quickly.
One week after the MEPs’ follow-up questions, Meta received an RFI from the European Commission regarding their ad-free subscription. They have until March 22 to provide the requested information.
MEP Paul Tang stated, “After tabling written questions multiple times to the European Commission, asking it to act upon Meta’s very questionable ‘pay or consent’ model, I’m happy the Commission is finally following up. It’s about time Meta faces the music and provides the answers all of us have been demanding.”
In parallel with the DSA attention on Meta’s consent or pay model, three data protection authorities have asked the European Data Protection Board for their opinion on the legality of this model, with a decision expected later this month. This view could affect how the GDPR is enforced on Meta’s mechanism.
We also reached out to the Irish DPC for an update on their review of Meta’s consent or pay model. A spokesperson stated that their assessment is still ongoing and they are currently unable to provide further information.
The Commission’s RFI to Meta today includes some further requests, covering topics that were already mentioned in previous RFIs under the DSA. The EU stated that these new requests build on their previous asks and require additional information on Meta’s risk assessments and mitigation measures reports, as well as their actions to protect minors and elections from manipulation. The RFI also asks for details on shadow banning and the launch of Threads.
Meta has until March 15 to provide the requested information. It is unclear if the EU will open a formal investigation under the DSA, but these numerous requests suggest that they are concerned about multiple compliance issues. The Commission will assess Meta’s responses and determine their next steps. They could also issue additional RFIs if they require more information. Penalties for providing incorrect, incomplete, or misleading information could also be imposed. We may have a better idea of the bloc’s plans within the next few weeks.
