The UK’s information watchdog has said publisher “consent or pay” cookie models are acceptable providing users have a “genuine free choice” and data protection laws are met.
“Consent or pay” is the blunt choice presented to website users, normally via a pop-up notice, that they must either consent to receive personalised advertising when visiting a site, or pay to avoid doing so.
The Information Commissioner’s Office (ICO) has produced guidance on “consent or pay” several months after the Mail, Mirror, Express, Independent, Times and Sun all rolled the model out.
The news websites have put a price on users choosing not to share their personal data ranging from The Times trying out £6.99 per month to Reach’s Mirror and Express on £1.99 each.
They chose to do so after the ICO got strict on a requirement for it to be as easy for users to “reject all” cookies as it is to accept them.
The ICO previously said the “consent or pay” model is not prohibited in principle under data protection law but consent must be “freely given” – unlikely if there is an “unreasonably high fee” – and “fully informed”.
It has now cemented this position but set out requirements publishers must meet to show a user has been able to give “valid consent”.
The four key factors to consider are:
- There may be a “clear power imbalance” if users do not have a “realistic choice” about whether or not to use the service;
- A fee would be an “unrealistic choice” for users if it is “inappropriately high”;
- There should be an “equivalent core service” across all options offered to users;
- And the choices must be presented equally with “clear understandable information” about what they mean – users hampered by “harmful design practices” cannot freely consent.
The ICO said it would be “more challenging to demonstrate freely given consent” if the price given for opting out of personalised advertising combines a fee for access to the core product with the fee for not sharing personal data.
“This is because paying a single price which combines these factors may mean that the fee is in appropriately high and can affect whether people can freely give their consent,” the ICO guidance states. “People may feel they are “priced out” and have no other choice than to consent in order to access the service.
“You may still charge for the provision of your products or services, but you should so outside of the alternative to consent.”
Most of the UK publishers that are trying out “consent or pay” present the option as separate to any of their other subscriptions.
As a case study, the ICO outlined how a news media website could offer premium content such as puzzles, op-eds and lifestyle supplements as well as their core news service and still ask users to consent or pay.
It set out that the news website may assess that “in order to offer the premium content, they will have to charge a fee which is higher than what their evidence indicates would be an appropriate fee for removing personalised ads” but that this “does not meet the ICO’s expectations for the appropriate fee factor”.
The ICO continues: “In order to ensure that their users have genuine freedom of choice, Organisation B introduces an additional, standard subscription option. This allows users to subscribe to receive the core service, with no personalised ads, for a fee which their evidence indicates would be appropriate. The standard subscription option allows users to access all basic news content, but not any of the additional content included in the premium subscription option. Alongside this, Organisation B continues to offer their premium subscription option for those who wish to access the additional content.”
Stephen Almond, the ICO’s executive director of regulatory risk, said in a blog post: “We will engage with publishers choosing to adopt “consent or pay” models to ensure that people’s information rights are upheld and we will take action where these models are introduced in ways that don’t allow for meaningful control.
“We understand that the ‘consent or pay’ model is new to many consumers and impacts how they access websites and online services. We have guidance to help the public navigate online tracking, how they have the right to meaningful choice over their personal information and what to do if they’re unhappy with or have concerns about a website’s model.
“With this work, we aim to simplify compliance processes and reduce the burden on businesses. We plan to promote innovation in advertising models that respect user privacy, helping to level the playing field and ensure that all organisations operate under the same rules, which will build trust with consumers and foster long-term business growth.”
ICO to continue cookie tracking scrutiny
The ICO started its crackdown on the compliant use of advertising cookies, making sure it is as easy to hit “reject all” as it is to “accept all”, for the UK’s top 100 websites in November 2023. Fifty-three of the sites received a warning that they needed to make changes, and in September it said 99 of them were now compliant with the exception of gossip forum Tattle Life.
The work was extended last year to the top 200 websites, with “significant improvements in compliance” made according to Almond.
The ICO was also looking at whether non-essential advertising cookies were being placed before users had the chance to give consent, and whether they were placed even if the user rejected their use.
The ICO has now said it will extend this work to the top 1,000 websites, which will include many news publishers. Almond said: “Our goal is to ensure that people see a noticeable improvement in their online experiences with clearer choices and fewer intrusive practices.”
Email pged@pressgazette.co.uk to point out mistakes, provide story tips or send in a letter for publication on our "Letters Page" blog
