A number of publishers, including Mail Online, The Independent, Daily Mirror, Daily Express and The Sun, now use “pay or consent” cookie models whereby readers are given the choice either to accept cookies in their browsing experience or to pay a subscription fee in order to reject cookies. Subscription fees, which generally range from £1.99 to £4.99 per month among the aforementioned publishers, allows readers cookie-free access to their sites meaning that readers will see basic, non-targeted ads but their data will not be shared between advertisers, nor will they be subject to personalised ads.

Why is payment being requested? 

The UK Information Commissioner’s Officer (ICO) requires that, in compliance with UK data protection legislation, cookie banners on UK businesses websites must enable users to reject non-essential advertising cookies as easily as they can accept them i.e. provide a “reject all” option in the same away as the “accept all” option. However, the ease of rejecting cookies coupled with users concerns surrounding internet privacy has led to a substantial decline in the number of users accepting cookies. Third-party cookies help marketers target more relevant adverts to consumers, which makes users who consent to them much more valuable than those who are effectively anonymous. 

In response to why it adopts this practice, The Independent notes that it relies on advertising to fund reporting, commentary and analysis and asks readers who do not want their cookies used for ad tracking and personalised advertising to support The Independent by paying for an advert-free experience instead. Effectively, it puts a price on readers’ privacy.

Is the “pay or consent” model lawful?

In response to the legality of the ‘pay or consent’ model, the ICO launched a ‘call for views’. While the outcome is yet to be formally published, the ICO’s emerging guidance is that while in principle data protection law doesn’t prohibit the approach, businesses should be careful to ensure that consent to processing of personal information for personalised advertising has been freely given. The price charged cannot be so high so that individuals feel they have no choice but to consent to cookies and give their data away. 

EU approach

Austria and Germany were among the first countries to adopt “pay or consent” cookie models back in 2021 and national data protection authorities issued decisions on whether the models were permitted. Austria ruled that readers must specifically be able to answer “yes” or “no” to cookie paywalls to ensure that consent is freely given, while Germany provided guidance to ensure that the models comply with GDPR principles.

Since this ,the European Data Protection Board (EDPB) issued an opinion following a request by the Dutch, Norwegian & Hamburg Data Protection Authorities that in most cases it is not possible for large online platforms to comply with consent requirements under EU GDPR if users are only given a binary choice between consenting to cookies or paying a fee. The EDPB provided that consent will not be freely given if data subjects cannot refuse or withdraw consent without detriment, and detriment may arise if non-consenting data subjects who do not pay the fee are excluded from the service or if the fee effectively inhibits data subjects from making a free choice. 

While the ICO’s initial view appears that it may adopt a similar approach to the EDPB, its stance on the use of ‘consent or pay’ models will become clearer once its upcoming guidance is published.