Does your business offer its customers the option to either consent to personalised advertising or pay a fee in order to access your services? If so, then the ICO's recent consent or pay guidance will apply to you.

How will the ICO guidance apply to me?

The guidance requires organisations to consider power imbalances, fee level, equivalence of the service offered and privacy by design to support and evidence that consent is truly freely given in a "consent or pay" model scenario. It is helpful in clarifying that "consent or pay" models are not prohibited in the UK, but also clear that the onus is on businesses to ensure they can clearly demonstrate that any consent obtained is valid.

This will involve:

• considering both the type of individual and your position in the market. If you are in a position of power (whether in the context of the wider market or due to the nature of the individual such as children), then consider other options such as contextual advertising;
• setting an appropriate fee based on the value individuals place on their privacy and personal data and not the value/cost to the organisation;
• making your core service equivalent across your "consent" and "pay" options; and
• ensuring the way you present consent is sufficiently clear and does not unduly influence individuals to make a specific choice.

Provided that you have considered privacy by design (completed a Data Protection Impact Assessment (DPIA) and presented a clear and compliant consent), set an appropriate fee, offered an equivalent core service and do not have a position of power with a particular group of individuals or in the market, the consent obtained through a "consent or pay" model can be validly obtained.

It is the element of power imbalance that is most outside an organisation's control – as it will either be in a position of power or not. If there is a power imbalance, this does not mean that you cannot use a "consent or pay" model. Instead, you will need to consider this in the context of your wider assessment and take steps to ensure that individuals can freely consent. This could include offering an additional option that does not rely on individuals consenting or paying a fee such as contextual advertising.

What are the key things you need to know?

In this article, we cover:

• Why is it potentially difficult to obtain a valid consent in a "consent or pay" model?
• What steps should organisations take to comply with the new ICO guidance?
  • Power imbalance
  • Appropriate fee
  • Equivalence
  • Privacy by design
• What your organisation needs to do now.

Why is it potentially difficult to obtain a valid consent in a "consent or pay" model?

The "consent or pay" model refers to situations where individuals are given the choice to:

• consent to the processing of their personal data (for the purposes of targeted advertising) and access the online service for free;
• pay a fee in order to access a version of the service that does not involve the processing of their personal data for targeted advertising purposes (although personal data may still be processed for other purposes such as wider analytics or service improvements); or
• not use the online service.

If seeking to rely on consent as a lawful basis, this must be freely given (with individuals having genuine choice and control), specific and informed (including providing details of who is relying on the consent, the processing that will be undertaken and the right to withdraw consent at any time), and unambiguous (a clear affirmative action such as ticking a box).

The main sticking point for "consent or pay" models is the requirement for consent to be freely given. The question is then, if the only alternatives are to pay a fee or simply not use the service, can consent truly be freely given?

What steps should organisations take to comply with ICO guidance?

The ICO sets out four factors which organisations should consider when building an argument to support a "consent or pay" model.

• Power imbalance

A fundamental principle of valid consent under UK GDPR is that it must be freely given. Where a significant power imbalance exists – such as where a platform holds a dominant market position or where users have little genuine alternative but to consent to personalised advertising – consent is unlikely to be considered freely given. Organisations should assess whether users can realistically exercise choice, particularly if the organisation holds a dominant position in the market.

Factors to be considered include the type of individual (such as employees or vulnerable individuals/children making a power imbalance more likely), the nature of your organisation (for example, public authorities have a position of power), the extent to which individuals rely on your service and your position in the market. The ICO requires all organisations to consider their market position and market power (whether or not they are dominant or otherwise have market power under competition law). Barriers to switching, including network effects and switching costs, should also be taken into account. 

The ICO is clear that if there is a power imbalance, then consent is unlikely to be valid. However, the ICO does note that it is still possible to operate a "consent or pay" model provided that steps are taken to address the power imbalance such as offering an additional alternative with contextual advertising (thereby avoiding the need to consent or pay to access the core service).

You should undertake an assessment of power imbalance, document this and keep it under review.

• Appropriate fee

For a "consent or pay" model to offer a valid consent, the fee charged under the "pay" option must not be so high as to effectively pressure individuals into consenting to personal data processing for the purposes of targeted advertising. The ICO states that an "appropriate fee" should be one that reasonably reflects the value users attribute to avoiding personalised advertising. If the fee is too high such that individuals are effectively priced out of the "pay" option and therefore feel they have no choice but to consent to personalised advertising, then consent will not be valid.

The ICO does not set prices for commercial organisations. However, it has provided a number of factors to consider when setting a fee, including the size of your organisation, market position and nature of processing.

The ICO is clear that the most appropriate measure of fee level is the value individuals place on not sharing personal information for the purposes of personalised advertising. Determining this value could include research of your user base, monitoring evidence of the value individuals place on protecting their privacy and the choices they make to protect their privacy in practice, and the impact of the fee on different consumer groups (including whether any will be priced out of the "pay" option).

Other models for determining an appropriate fee that are unlikely to be appropriate include:

• revenue that your organisation might lose as a result of a reduction in personalised advertising;
• costs; and
• consumer valuation of the core service.

It is clear from these examples that the focus is on the value to the individual and not the benefits/costs to the organisation in relation to personalised advertising and the processing of personal data.

• Equivalence

The ICO emphasises that the "consent" and "pay" versions of a service should be equivalent in nature, meaning that individuals who opt to pay should not receive a significantly downgraded or lower quality experience compared to those opting to consent to personalised advertising.

Equivalence does not mean the core service must be identical. Additional perks/features can be included in either service provided that the core service is equivalent and that the benefits/features do not penalise individuals who refuse consent, change the core service or increase the price of the pay option to an inappropriate fee. Equivalence should consider functionality, features, available content, personalisation and individuals' control over their personal data.

You will need to identify what your core service is (such as through terms and conditions, or marketing materials) and be able to demonstrate that both consent and pay options provide this core service. This assessment should be reviewed if there are changes that may impact the equivalence of the core service offered.

• Privacy by design

"Consent or pay" models must incorporate privacy by design, ensuring that privacy considerations are embedded into the service from the outset. Organisations should ensure that clear and transparent information is provided to individuals about what each option entails, giving them meaningful control over their personal data. The consent mechanism should be designed to be easily understandable, and withdrawing consent should be as simple and accessible as giving consent. Organisations should conduct a DPIA to assess risks associated with their model and document how compliance with consent requirements is achieved.

A key element of privacy by design in the context of "consent or pay" models is how the consent is presented to individuals. In practice, this means:

• presenting the options clearly so individuals can understand what each option means –avoiding confusing language such as "continue to read for free" where individuals may not realise they are agreeing to personalised advertising;
• not using harmful design practices – this would include any nudges to encourage individuals to make a particular choice e.g. by making one option much easier or more obvious, pressuring individuals to make a particular choice by making one choice "bad"/less socially acceptable or emphasising the benefits/negatives of one option to encourage individuals to make a particular choice;
• not pressurising individuals to make a quick decision;
• ensuring the consent option is specific to personalised advertising and does not cover any other purposes such as retargeting on other websites; and
• telling individuals they have the right to withdraw consent at any time and how to do so (withdrawing consent should be a simple process that is easy to find).

If consent is withdrawn, processes should be in place to ensure any processing stops and that personalised advertising ceases. Other organisations to which you disclosed personal data should also be informed of the withdrawal of consent. Withdrawal should be treated as an erasure request with personal data that was collected under the consent deleted. If an individual withdraws consent to personalised advertising, they can be taken back to the original pay or consent options – a withdrawal of consent does not mean you have to provide your service for free.

Although the "pay" option does not involve obtaining consent, this must still be designed with privacy by design in mind, including ensuring that transparent information is provided on the personal data that will be processed.

The ICO also sets out some specific cookies/related technology requirements. It reaffirms existing requirements to ensure that consent is collected prior to deploying personalised advertising cookies and specifically states personalised advertising cookies should be session-based rather than persistent.

These requirements in relation to cookies and how consent is presented are not new. Instead, the inclusion in the ICO guidance indicates that how consent is presented will be a key element taken into account in determining whether a "consent or pay" model has collected a valid consent.

What your organisation needs to do now

If your organisation operates or is considering operating a "consent or pay" model, you should:

• review your "consent or pay" model against the ICO guidance;
• complete a DPIA; and
• document and evidence your assessment of how your model offers a valid consent.

Where can I find out more?

The ICO guidance is available here. If you have any questions or issues you would like to discuss with us, please do get in touch.