In March 2024, the debate around Meta’s European advertising model was approaching a critical point.

Meta had introduced a subscription model under which users of Facebook and Instagram could either continue using the services with personalised advertising or pay for an advertising-free version.

Critics described the approach as “pay or okay”: consent to behavioural advertising or pay to avoid it.

The debate raised a fundamental question under European data-protection law:

Can consent genuinely be considered freely given where declining behavioural advertising carries a financial cost?

When the original Privacy Minders article was published, 28 privacy and consumer organisations had urged the European Data Protection Board to reject the model, while Dutch, Norwegian and Hamburg supervisory authorities had asked the EDPB for an Article 64(2) opinion.

The EDPB issued that Opinion less than a month later.

Since then, the regulatory story has expanded considerably.

What began primarily as a GDPR debate about valid consent has also become a Digital Markets Act enforcement issue concerning user choice, data combination and less-personalised alternatives.

Meta itself has changed the model several times.

The result is no longer a simple question of whether users should “pay for privacy”.

It is a broader regulatory question about what constitutes genuine choice in digital services funded by personalised advertising.

The background stretches back to regulatory proceedings concerning Meta’s legal basis for behavioural advertising.

On 27 October 2023, the European Data Protection Board adopted Urgent Binding Decision 01/2023 following a request from the Norwegian supervisory authority.

The decision concerned Meta Platforms Ireland’s processing of personal data for behavioural advertising on the legal bases of contract and legitimate interests.

Following the EDPB decision, the Irish supervisory authority imposed an EEA-wide ban on that processing on those legal bases.

Meta subsequently moved toward a consent-based model.

In November 2023, the company introduced its Subscription for no ads model in the EU, EEA and Switzerland.

Users were presented with a choice between:

  • using Facebook and Instagram without paying while accepting personalised advertising; or
  • paying a monthly subscription for an advertising-free version.

That binary structure became the focus of the “Consent or Pay” debate.

Privacy and consumer organisations challenged the model

On 16 February 2024, a coalition of 28 privacy and consumer organisations sent a joint letter to the European Data Protection Board.

The signatories included organisations such as noyb, the Irish Council for Civil Liberties, Wikimedia Europe and the Electronic Privacy Information Center.

Their concern was wider than Meta alone.

They argued that, if large online services could place a monetary price on refusing consent, the model could spread across sectors that monetise personal data.

From that perspective, the question was not simply whether Meta’s subscription price was appropriate.

It was whether conditioning a privacy-preserving option on payment could undermine the requirement that consent be freely given.

The organisations also argued that differences in users’ financial circumstances could materially affect whether the choice was genuine.

Those arguments formed part of a much broader policy debate already taking place before the EDPB.

On 17 April 2024, the EDPB adopted Opinion 08/2024 on valid consent in the context of Consent or Pay models implemented by large online platforms.

The Opinion is important because its conclusion was more nuanced than a categorical prohibition.

The EDPB did not state that every Consent or Pay model is automatically unlawful.

Instead, it concluded that, in most cases, large online platforms are unlikely to meet the requirements for valid consent where users are confronted only with a binary choice between:

  • consenting to the processing of personal data for behavioural advertising; or
  • paying a fee.

The key issue is whether consent remains genuinely freely given.

The EDPB identified factors including:

  • conditionality;
  • detriment;
  • imbalance of power;
  • the appropriateness and level of any fee;
  • whether users risk exclusion from an important service;
  • granularity;
  • transparency;
  • whether consent is specific and informed; and
  • whether the controller can demonstrate compliance with the wider GDPR principles.

Why a free alternative matters

One of the most important aspects of Opinion 08/2024 concerns alternatives.

The EDPB considered that offering only a paid alternative to behavioural advertising should not become the default approach for large online platforms.

Where a controller chooses to charge for an advertising-free alternative, the Board said significant consideration should also be given to an additional free alternative that does not involve behavioural advertising.

That alternative might, for example, use contextual advertising or significantly less personal data.

The presence of such an option can have a substantial effect on the assessment of whether users experience detriment when refusing behavioural-advertising consent.

This moved the discussion beyond the simple binary:

CONSENT OR PAY

toward a broader question:

What alternatives are realistically available to the user?

Opinion 08/2024 also makes another important point.

Even where valid consent can be obtained, consent does not exempt the controller from the other GDPR principles.

Processing still needs to satisfy requirements such as:

  • fairness;
  • purpose limitation;
  • data minimisation;
  • transparency;
  • necessity;
  • proportionality; and
  • accountability.

A Consent or Pay implementation therefore cannot be assessed solely by asking whether the user clicked an accept button.

The organisation must consider the design of the choice, the information provided, the consequences of refusal and the processing that follows from the consent.

Meta subsequently changed its European advertising choices

The model did not remain static after the EDPB Opinion.

In November 2024, Meta announced several changes for users in the EU.

The company reduced the price of its advertising-free subscription and introduced an additional free option involving less-personalised advertising.

Under that option, Meta said it would use significantly less data to select advertisements, relying primarily on contextual information relating to the user’s current session together with a more limited set of data points.

The change was significant because the model was no longer purely binary.

Users could now encounter different advertising experiences involving different levels of personalisation and data use.

That development also illustrates why the Consent or Pay debate increasingly intersects with another European regulatory framework:

the Digital Markets Act.

The EDPB Opinion concerns the GDPR.

The European Commission’s subsequent enforcement action against Meta concerned the Digital Markets Act.

Those frameworks should not be conflated.

Under the GDPR, the central question is whether the processing of personal data has a valid legal basis and whether consent, where relied upon, satisfies requirements such as being freely given, specific, informed and unambiguous.

Under Article 5(2) of the DMA, a designated gatekeeper faces separate rules concerning the combination and cross-use of personal data across designated core platform services and other services.

Where users do not consent to such data combination, the DMA requires access to a less-personalised but equivalent alternative.

The two frameworks can therefore address overlapping factual circumstances while applying different legal tests.

The European Commission took enforcement action under the DMA

On 1 July 2024, the European Commission issued preliminary findings concerning Meta’s Consent or Pay model under the Digital Markets Act.

The Commission’s preliminary view was that the binary model did not provide users with the less-personalised but equivalent alternative required under Article 5(2) DMA.

The proceedings continued.

On 23 April 2025, the Commission adopted a non-compliance decision finding that Meta had breached the DMA requirement to provide users with the required choice.

The Commission imposed a €200 million fine.

The decision concerned the period in which EU users were presented with the binary Consent or Pay model after the DMA obligations became legally binding and before Meta introduced its changed advertising model in November 2024.

This is an important distinction.

The Commission’s decision was a DMA enforcement action.

It should not be described as an EDPB or GDPR fine concerning Consent or Pay.

The regulatory debate then moved to less-personalised advertising

Meta’s November 2024 changes introduced a less-personalised advertising option for users choosing free access with advertising.

The European Commission continued to assess whether the revised model provided the effective choice required by the DMA.

The existence of a less-personalised option therefore did not automatically conclude the regulatory assessment.

Regulators needed to consider how the choice worked in practice, including:

  • how much less data was used;
  • whether the alternative remained equivalent;
  • how users were presented with the choice;
  • whether the design encouraged one option over another; and
  • whether refusal of fuller personalisation resulted in material disadvantage.

This demonstrates an important broader point.

Regulatory analysis increasingly examines the actual user experience, rather than only the labels applied to the available options.

Meta’s choice architecture continued to evolve

Following further dialogue with the European Commission, the regulatory position continued to develop during 2025.

In December 2025, the Commission acknowledged an undertaking by Meta to provide EU users with an alternative choice designed to allow them to share less personal data and receive more limited personalised advertising.

The Commission said that the updated choices would be presented to users from January 2026 and that it would assess their implementation and practical impact.

During 2026, Meta and the other designated gatekeepers have continued to submit updated DMA compliance reports to the Commission.

The Commission has stated that it will assess those updated compliance measures through its ongoing regulatory dialogue and enforcement processes.

Accordingly, the story should not be reduced to a final conclusion that Meta’s current advertising-choice model has been permanently endorsed.

The regulatory position has developed through successive changes, commitments and assessments.

The broader GDPR question remains relevant

The EDPB’s 2024 Opinion focused specifically on Consent or Pay models used by large online platforms.

The Board also announced that it would develop broader guidelines addressing Consent or Pay models beyond that specific context.

As of September 2026, those broader guidelines remain part of the EDPB’s ongoing work programme.

The issue therefore remains relevant beyond Meta.

Publishers, platforms and other digital services considering models that combine:

  • consent to data processing;
  • paid access;
  • advertising-funded alternatives; or
  • different levels of personalisation

need to assess the design in its own factual context.

There is no safe rule that:

“Consent or Pay is always lawful”

or that:

“Consent or Pay is always unlawful”.

The validity of consent remains fact-specific.

The fee is only one part of the analysis

The original 2024 debate focused heavily on whether users were effectively being asked to pay for privacy.

The EDPB’s Opinion shows that the analysis is broader.

The amount of any fee can matter because an excessive cost may create pressure to consent.

But regulators may also consider:

  • the market position of the platform;
  • dependence on the service;
  • network effects;
  • the consequences of refusing consent;
  • whether users lose access to content or relationships;
  • the existence of realistic alternatives;
  • how the choices are presented;
  • whether purposes are sufficiently granular; and
  • whether users can understand the consequences of each option.

The correct question is therefore not simply:

“Is there a fee?”

It is:

Does the overall design allow a genuinely free and informed choice?

Consent validity cannot be separated completely from interface design.

A controller may formally present several options while still designing the interface in a way that steers users toward the most data-intensive choice.

Relevant considerations can include:

  • prominence;
  • button design;
  • wording;
  • repeated prompts;
  • additional steps;
  • visual hierarchy;
  • friction;
  • default selections; and
  • the consequences attached to each route.

The EDPB’s Opinion expressly points to its guidance on deceptive design patterns when discussing how information and choices should be presented.

For businesses developing subscription or advertising-choice models, privacy analysis therefore needs to involve both:

  • the legal architecture of consent; and
  • the practical architecture of the user interface.

What other digital businesses should take from the Meta case

The regulatory history surrounding Meta does not create a universal template that every business must follow.

Meta is a large online platform and a designated gatekeeper under the DMA.

Many other businesses will not be subject to the same combination of regulatory regimes.

But the case provides useful lessons for any organisation considering a Consent or Pay model.

A business should assess:

  1. Why consent is required

    Identify the processing for which consent is being sought and whether another legal basis is genuinely available.

  2. What happens if the user refuses

    Consider whether refusal results in exclusion, material loss of functionality or another disadvantage.

  3. Whether payment creates pressure

    Assess whether the fee could make refusal unrealistic for a meaningful proportion of users.

  4. Whether a free less-data-intensive option is possible

    Consider alternatives such as contextual advertising or reduced personalisation.

  5. Whether the alternatives are genuinely equivalent

    A nominal alternative may not provide genuine choice if it materially degrades the service.

  6. How the interface presents the options

    Review whether design, language or friction influences the user toward consent.

  7. Whether other regulation applies

    Large platforms may face additional requirements under frameworks such as the DMA, while other businesses may need to consider consumer-protection, ePrivacy or sector-specific rules.

Before introducing a Consent or Pay model, an organisation can structure its review across four layers.

01 · PROCESSING AND LEGAL BASIS

Identify the personal-data processing involved, its purposes and the legal basis proposed for each purpose.

02 · CHOICE ARCHITECTURE

Map every option offered to users, including paid, advertising-funded and less-personalised alternatives, and identify the consequences of selecting or rejecting each option.

03 · CONSENT VALIDITY

Assess freedom of choice, detriment, imbalance of power, conditionality, fee levels, granularity, transparency and withdrawal.

04 · CROSS-REGULATORY ANALYSIS

Determine whether other frameworks, including ePrivacy, consumer-protection rules or the Digital Markets Act, create additional requirements for the business model.

The output should document why the organisation considers that users retain a genuine choice and how that conclusion will be monitored as the product and regulatory environment evolve.

From “Pay or Okay” to genuine choice

When the original Privacy Minders article was published in March 2024, the central question was whether Meta’s new subscription model could transform privacy into something users effectively had to purchase.

The regulatory developments since then have produced a more detailed framework for answering that question.

The EDPB has emphasised that large online platforms generally cannot assume that a binary choice between behavioural-advertising consent and payment produces freely given consent.

The European Commission, applying the DMA, has separately required Meta to provide users with a less-personalised alternative and has taken enforcement action against the earlier binary model.

Meta has in turn modified its advertising and subscription options several times.

The broader lesson is not that paid privacy models are categorically prohibited.

It is that genuine choice must exist in substance rather than only in form.

For any organisation considering a Consent or Pay model, the relevant analysis therefore extends beyond the existence of a consent button and a subscription price.

It reaches the full architecture of the choice:

  • the alternatives offered;
  • the data used;
  • the consequences of refusal;
  • the interface through which the choice is made; and
  • the regulatory frameworks that apply to the business.