On January 26, 2024, the Norwegian data protection authority (Datatilsynet) and Dutch data protection authority (AP) announced that they, alongside the Hamburg Commissioner for Data Protection and Freedom of Information (HmbBfDI), asked the European Data Protection Board (EDPB) to give an opinion on 'consent or pay' practices on the basis of Article 64(2) of the General Data Protection Regulation (GDPR).

The aforementioned data protection authorities sent this request because of the differing approaches to 'consent or pay' practices throughout Europe, with some data protection authorities allowing for it while others have not. Furthermore, the Court of Justice of the European Union (CJEU) did not elaborate under which circumstances this practice is legal. The AP stated that in this case, the question is whether 'consent or pay' practices meet the requirements for consent under the GDPR.

Problems with 'consent or pay' practices

Both the Norwegian Datatilsynet and the AP mention how 'consent or pay' practices may be problematic, particularly with popular online services. Both data protection authorities stated that users may feel dependent on such services to communicate with family and friends or to access important information and content. Due to this, the AP considered the following questions:

• does this imply a pressure to consent?

• does withholding consent lead to detriment, particularly for low-income users?
• is the price fair?

Next steps

The EDPB must issue a statement within eight weeks. If this is not possible, the deadline can be extended by a further six weeks, giving the EDPB up to 14 weeks in total to process the matter.

You can read the Datatilsynet's press release here, the AP's press release, only available in Dutch, here, and the HmbBfDI's press release here.