New battle lines appear to be being drawn up in the European Union between Facebook and Instagram owner Meta and regional users’ privacy rights.

As it stands, the tech giant is running ads unlawfully in the EU since they target users by tracking and profiling their activity without a valid legal basis. This follows a landmark ruling by the bloc’s top court this summer denying its ability to claim a legitimate interest for this type of personal data processing; and a major decision in January by privacy regulators which found the company cannot claim contractual necessity either.

That leaves consent. And consent under the bloc’s General Data Protection Regulation (GDPR) must be informed, specific and freely given. However freely given hasn’t always been interpreted to mean free, as in gratis — thanks to a push by certain news publishers to put up content paywalls that ask users to subscribe to their journalism or accept tracking ads.

Meta appears to be manoeuvring towards adopting the same approach in a bid to squeeze its surveillance business model past regulators again, meaning it would be able to keep tracking and profiling users in the EU — unless they pay it for their privacy…

Yesterday The Wall Street Journal reported the adtech giant is in talks with the bloc’s data protection regulators to launch an ad-free subscription version of its service in the region. Users who do not want to pay a fee of $14 or even $17 per month to access Meta apps Facebook and Instagram would have to accept its so-called “personalized ads”, aka Meta’s tracking and profiling of their online activity, if they want to access its social networking services.

Meta spokesman, Matt Pollard, refused to confirm or deny the WSJ report. But his email pointed to what was couched as “additional context” — in the form of a paragraph of the recent Court of Justice of the EU judgment in which the court suggests users who refuse to consent to data processing should not have to refrain from using the service entirely but should be provided with “an equivalent alternative not accompanied by such data processing operations”… “if necessary for an appropriate fee”. So Meta is at least highlighting the idea that it might charge a fee.

In an emailed statement it added that it is continuing to “explore options” — writing:

Meta believes in the value of free services which are supported by personalized ads. However, we continue to explore options to ensure we comply with evolving regulatory requirements. We have nothing further to share at this time.

A blog post Meta put out this summer, when it announced an “intention” to move to consent for its tracking ads, didn’t mention the idea of charging a fee. But it claimed [emphasis ours]: “Once this change is in place, advertisers will still be able to run personalised advertising campaigns to reach potential customers and grow their businesses.”

Would paying Meta $14 a month not to snoop on you meet the GDPR’s standard of freely given consent? Not literally, clearly. Nor does it obviously respect the spirit of the EU’s fundamental rights framework, which does not dole out protections based on individuals’ ability to pay.

But would a choice of paying a fee or paying with your privacy breach the rules? Courts would likely have to weigh in to clarify interpretation of the GDPR’s standard for freely given consent.

The legality of any such move by Meta will undoubtedly face fresh legal challenge, as privacy rights advocacy group noyb — which has already chalked up a series of major GDPR strikes against Meta — confirmed today. Indeed, noyb has been challenging news publishers’ “pay or okay” approach since 2021, filing a series of complaints with data protection authorities. So it has a head start on challenging any similar pay-for-your-privacy tactic by Meta.

“Fundamental rights cannot be for sale,” said noyb’s founder and honorary chairman, Max Schrems, in a statement today. “Are we going to pay for the right to vote or the right to free speech next? This would mean that only the rich can enjoy these rights, at a time when many people are struggling to make ends meet. Introducing this idea in the area of your right to data protection is a major shift. We would fight this up and down the courts.”

In a message exchange with TechCrunch, Schrems also pointed to the CJEU paragraph floating the possibility of an “appropriate fee” — which he dubbed an orbiter dictum — going on to describe the suggestion a Big Tech giant like Meta could charge a fee for tracking-ad-free access as “very alarming”. “We would move towards ‘pay for your rights’,” he warned.

“The CJEU said that the alternative to ads must be ‘necessary’ and the fee must be ‘appropriate’. I don’t think €160 a year is what they had in mind,” he added in noyb’s press release. “These six words are also an ‘orbiter dictum‘, a non-binding element that went beyond the core case before the CJEU. For Meta this is not the most stable case law and we will clearly fight against such an approach.”

While data protection authorities have been willing to allow news publishers to offer users a choice of ‘subscribe or be tracked’ they are commercial entities which do (at least) produce journalism (with all the cost that work entails) — whereas Meta would simply be putting a paywall around user generated content (UGC) which was freely uploaded to its platform. So it’s interesting to consider what an “appropriate” or indeed “necessary” fee might mean in Meta’s context.

Freely uploaded content sounds pretty cheap to me. And given Meta gets content from its users for free, why is it necessary for it to charge anything at all? It’s not like a service like Spotify premium (circa $11pm for individuals) where the streaming giant has to pay to license the songs it delivers to ad-free to subscribers.

Meta floating the idea of charging $14pm — or even $4 — looks like a bad joke.

Add to that, there is no prohibition on Meta implementing other types of advertising that don’t require processing user data. Such as contextual advertising.

So if the company really is proposing to implement a binary choice of either an ad-free subscription or tracking-and-profiling-based ad-targeting it’s framing a false choice in the (self-serving) interests of maintaining a privacy-hostile surveillance business model. (And, well, you’d expect EU judges to be wise to such an obviously bad faith move, as they have been to earlier Meta GDPR circumventions. Although getting a case referred up to the CJEU would likely take a few years.)

Per noyb, the ‘pay or okay’ approach was originally developed by Austrian newspaper, Der Standard which asked users to either agree to the processing of personal data for advertising or fork out a fee of €8.90 per month (up to €107 per year) to access its journalism ad-free — which is notably a lower fee than the charge Meta is reported to have suggested.

Other DPAs in Germany and France have since green-lit the approach as a way to support journalism. The irony now is Meta appears to be planning to avail itself of this news publisher carve-out — without itself being in the journalism business. And when adtech giants like Meta stand accused of gobbling up ad revenues that used to fund the news media… So the prospect of Big Tech repurposing a CJEU ruling to keep profiting at users’ expense would be dismal indeed. (“We see that regulators have allowed ‘Pay or Okay’ models to support journalism in times when advertising revenue was sucked up by Google, Meta and the like. Now this loophole is used by Big Tech,” as Schrems notes.)

Notably, TikTok has also recently been spotted testing an ad-free subscription version of its service — which may suggest it’s thinking along similar lines to Meta. In the EU the company’s bid to switch away from obtaining consent to a legitimate interest basis for its tracking-ads processing was thwarted after a regulatory intervention last year.

Ireland’s Data Protection Commission (DPC), which is Meta’s (and TikTok’s) lead supervisor for the GDPR, told us it’s unable to comment on the Meta legal basis issue at present.

For some months, since the CJEU ruling, the DPC — along with other EU DPAs — has been engaged with Meta to assess its compliance in the wake of the court’s decision. We understand this process remains ongoing. There is no public timeline for Meta’s touted upcoming switch to consent.

In parallel, the Norwegian data protection authority issued its own local prohibition on Meta’s tracking ads this summer. Recently it also referred the matter to the European Data Protection Board asking it to take a binding decision.

A spokesman for Norway’s authority told TechCrunch it’s very concerned about reports of Meta considering asking for consent to be tracked or else a fee.

“In the [CJEU] judgment, the CJEU did suggest that pay or okay may be acceptable in some cases. However, the court also highlighted that it is important to assess whether there exists a power imbalance that may affect the freedom of choice of users. The latter aspect is key here,” said the spokesman.

“Meta owns the biggest social media platforms, and it would be difficult for users to find viable alternative services. This is in part due to so-called network effects, meaning that users will want to be where ‘everyone else’ is — and in this case, ‘everyone’ is on Facebook and Instagram. Furthermore, Meta has offered their services free of charge for the best part of two decades, which has led to many people heavily investing their digital lives in these services. For a large number of users, it would be safe to say that Facebook and Instagram has become essential informational and relational infrastructure.

“For a lot of people, being on Facebook or Instagram is an integral part of their digital lives. This does suggest a clear power imbalance. If Meta then suddenly says to users, “pay or give away your privacy”, this may put users in a very difficult position, especially those who cannot afford to add an extra fee to their monthly budget. If these plans materialise, we are deeply worried that data protection would become a right reserved for the wealthy.”

“Of course, we have to wait and see what happens but we are very concerned,” the spokesman added, specifying that EU data protection authorities continue to “monitor and exchange on this issue”.

Meta, in the meanwhile, has been able to keep running “personalized ads” in the region which break EU law — hence why the Norwegian DPA took emergency action to implement a local ban (although Meta has flouted its order and faces fines of ~$100,000 per day for refusing to stop its breach of the GDPR — aka, just another cost of being in the surveillance business).

Another consideration here is what the European Commission will do.

It’s the sole enforcer for the EU’s newly applied Digital Markets Act (DMA) — an ex ante competition regulation that seeks to put up-front obligations on the most powerful platforms with the goal of levelling the competitive playing field online and promoting open and contestable markets. Meta was officially designated a gatekeeper last month.

Among a variety of requirements this pan-EU regulation applies on gatekeepers are that those platforms which directly collect personal data for advertising from third party websites and apps (as Meta does) must enable users to “freely choose to opt-in to such data processing and sign-in practices by offering a less personalised but equivalent alternative, and without making the use of the core platform service or certain functionalities thereof conditional upon the end user’s consent”.

The regulation also stipulates that “not giving consent should not be more difficult than giving consent”; and asserts that “consent should be given by a clear affirmative action or statement establishing a freely given, specific, informed and unambiguous indication of agreement by the end user, as defined in Regulation (EU) 2016/679 [aka, the GDPR]”.

Whether the Commission would accept a user needing to sign up for a Meta subscription — and paying a substantial ongoing monthly fee to the tech giant — as being equivalent in difficulty to hitting an “accept tracking ads” button which lets Meta keep torching their privacy is one rather pertinent question to ponder.

The DMA is a flagship competition reform for the bloc. When it comes to reining in platform power, as its executive (and the law’s proposer) the Commission will surely have been hoping the regulation delivers the kind of quick wins against Big Tech that have proven impossible under classic antitrust procedures, which requires painstaking after-the-fact investigation prior to any enforcement.

If Meta has found a way to play an existing EU regulation off against a shiny new one in the interests of preventing reform of its privacy-hostile business model it would represent a dual failure for the bloc’s regulators. Having to wait years for the CJEU to clarify interpretation of a passing remark in GDPR litigation vis-a-vis the quality of consent can’t have been what the Commission had in mind for its flagship antitrust reform.

We’ve reached out to the EU’s competition unit to ask if it has any concerns about reports Meta is looking to switch to charging regional users a fee to avoid being tracked and profiled in light of the obligations applied to gatekeepers like Meta in the DMA.

A Commission spokesperson said it does not comment on business decisions of companies, including those designated as gatekeepers under the DMA.

“Companies designated as gatekeepers have six months to develop concrete solutions to ensure full compliance with the DMA (until 7 March 2024). The Commission is in discussions with the designated gatekeepers on their compliance with the DMA,” the Commission spokesperson added. “It is for the designated companies to demonstrate effective compliance. To this end, they are due to submit a detailed compliance report in which they outline how they comply with each of the obligations of the DMA by 7 March 2024.”

Asked for her assessment, Miranda Cole, an antitrust and competition partner in the law firm Norton Rose Fulbright’s Brussels office, told TechCrunch: “Meta is likely pointing to the reference in the ECJ judgment to an ‘appropriate fee’ being imposed ‘if necessary’ for a service that does not track users. The question, of course, is how much is ‘appropriate’, bearing in mind that demand for such a subscription service, versus a tracking service, will be heavily dependent on how much it costs. As with app store transaction fees, the European Commission will have to take a view as to whether it is ‘appropriate’ to set fees at levels that preserve what might be viewed as extracting monopoly rents.”

This report was updated with additional comment. We also fixed a typo in Meta spokesman Matt Pollard’s surname.