We already reported several times on “Cookie Walls” for consent banners, most recently when the banner on heise.de was examined by the Lower Saxony data protection authority in July.
As a reminder: These consent models force users to choose between a tracking-free, paid version and a free version financed by (targeted) advertising to access a website. With the latter, users give their consent for their data to be processed for advertising purposes by a number of third parties.
NOYB now reports, citing an article in the Wall Street Journal, that Meta is planning to implement just such a model on its platforms. The company is apparently basing this decision on a clause in the ECJ’s reasoning in its judgement on “off-Facebook data” against Meta in July 2023 (read our report), which appears to allow a fee to be charged for an alternative tracking-free online environment. In this respect, Meta is considering charging a price of 14 USD per month (168 USD per year) for the paid version.
NOYB announced that it will go to court if Meta introduces the new model.
The decision has practical significance beyond social media, as Meta’s plans are in line with other developments of recent months: Following the ECJ ruling in July 2023, the business was forced to obtain valid consent for processing for marketing and advertising purposes, although Meta’s press release at the time already raised questions as to whether the company would actually be able establish a legally compliant situation (as reported in our newsletter). The business now appears to pursue the “Cookie Wall” option to respond to the unavoidable requirement to obtain valid user consent for advertising purposes, while also preventing a stop to the flow of valuable user data. In view of the high price, most users will likely opt for the free, targeted-advertising-based option.
However, Meta will still be required to comply with the GDPR for the “Cookie Calls”, as the German DSK body pointed out in a decision earlier this year (as also reported in our newsletter). So far, the use of “Cookie Walls” has been uncommon outside the field of online journalism – which means that Meta is entering uncharted waters.
EDPB adopts urgent decision
On 27 October, the European Data Protection Board (EDPB) adopted an urgent decision on the applicable legal basis for the processing of personal data for advertising purposes.
It ordered the Irish data protection supervisory authority to take final action in relation to Meta Ireland Limited (Meta IE) within two weeks, and imposed a ban on the processing of personal data for behavioural advertising when relying on legitimate interests or the performance of a user agreement as the legal basis throughout the European Economic Area.
In the meantime, the Hamburg data protection supervisory authority has also commented on the planned payment model for Facebook and Instagram.
As always, we will continue to update on this issue.
(Dr. Lukas Mezger, UNVERZAGT Rechtsanwälte & ePrivacy GmbH)