Ad-free reading models (also known as PUR models) provide end-users with a choice: pay a fee to access ad-free content or provide consent to a list of vendors (and purposes) specified by the publisher. With Meta adopting a PUR model this month, David Pfau, Head of Data & Privacy at Conreri discusses the implications…
On Monday, Oct. 30, 2023, Meta announced in an official statement that the Facebook and Instagram platforms will introduce a PUR model from November 2023. In future, each user will be free to choose how to use and fund the two Meta platforms.
Users will be faced with a choice: they can either opt for a paid subscription that offers them an ad-free experience or they can consent to the processing of their data for the purposes of personalised advertising and use the platforms in their current form free of charge.
In the context of the legal discourse around the PUR model, it is essential to understand that the issue is not that users pay for their own privacy, but for access to services and content that would otherwise be financed by personalized advertising.
Background to the decision
After a considerable number of European service providers have already made the move towards a PUR model, Meta is now also joining this approach. This strategic change of course is not only due to the positive experience gained in connection with the PUR model, but also to regulatory developments in Europe. In particular, the recent rulings and ongoing proceedings between Meta and European regulatory bodies are relevant here.
Another interesting aspect relates to the pricing of the ad-free subscriptions, which differs at Meta depending on whether they are used via the web or app. This differentiation is due to the fees charged by app store providers Google and Apple. It is noteworthy that app providers have rarely passed on store provider fees to end users in such a transparent manner.
Evaluation criteria for the admissibility of PUR
A number of important stakeholders, namely the European Data Protection Board, the German Data Protection Conference (DSK), the French supervisory authority CNIL, as well as the European Court of Justice (ECJ), among others, have already taken a position on the legal issues in the context of PUR models.
For a comprehensive overview of the current status in Europe, including the technical and economic parameters as well as the various legal positions, we recommend the recently published PUR market overview by the Bundesverband Digitale Wirtschaft (BVDW) eV (English translation). This offers an in-depth analysis and can serve as an essential source of information for all interested parties.
The question of the admissibility of PUR models is currently determined by the following criteria:
Equivalent alternative: the PUR subscription must be an equivalent alternative to the service that users obtain by giving consent to tracking and advertising. If the service is the same with the exception of the advertising and the associated data processing, one can generally speak of equivalence.
Legal conformity of consent: The effectiveness requirements for consent standardized in the GDPR, i.e., in particular, the requirements listed in Art. 4 No. 11 as well as Art. 7 GDPR, must be met.
Granularity of consent: According to the opinion of a wide variety of data protection supervisory authorities, users must be able to select and deselect the different purposes of data processing on a granular basis. This is contrasted with a more business-friendly interpretation that purpose aggregation is permissible. Regarding the announcement of Meta, it seems to be about the specific purpose of personalized advertising, based on First Party Data. Users must separately consent to the use of Third Party Data for advertising purposes.
In the ECJ ruling of July 4, 2023, subscription models are also endorsed by it when it stated that users “may, where appropriate, be offered, for a reasonable fee, an equivalent alternative which does not involve such data processing operations” (para. 150).
In summary, the various stakeholders largely agree that PUR models are in principle legally permissible. Accordingly, the focus is on the specific design of these models to ensure their compliance with the legal framework.
Overall, PUR models show promising opportunities for the future of data-driven business models based on data processing that requires consent. However, the specific design of the PUR models and their data protection assessment will continue to develop dynamically for some time. This can be seen, for example, in the fact that PUR is gradually being discussed outside of German-speaking countries.
The Federal Association of the Digital Economy (BVDW) eV
Conclusion and outlook
Meta’s step shows that, in the area of tension between regulatory developments and the economic needs of service providers, the question of how content and services will be accessible on the Internet in the future will become increasingly important. In addition, this step, which was also pushed by the data protection supervisory authorities, signals the shift of decision-making power back into the hands of users in the form of consent under data protection law.
Whether this ultimately serves informal self-determination and thus data protection in the digital age is another debate. Various initiatives at the EU level, as well as at the national level, are currently trying to address the problem of consent fatigue.
These developments are likely to further intensify the debate around PUR models and the related legal issues, especially the voluntariness of consent. It is to be expected that the discussion will become increasingly emotional. A particular focus could be on the assessment of appropriateness based on price. However, such a one-sided approach would be severely truncated from various perspectives, and it also raises the question of whether data protection supervisory authorities are in a position to assess the appropriateness of the price, provided it is neither “unrealistic” nor “exorbitant.”
Against this background, it is advisable that all involved stakeholders focus on the above mentioned evaluation criteria in order to have an informed discussion.
David Pfau
Head of Data & Privacy, conreri
Update: There has now been a decision by the European Data Protection Board on Meta, which could have far-reaching consequences for publishers and the digital advertising industry. In short, the EDPB has determined that Meta violates the General Data Protection Regulation (GDPR) when processing personal data for the purpose of behavioral advertising, based on the legal basis of legitimate interest. More info here: https://tinyurl.com/59dt2h7z (translation app required). Developing…
conreri is a management consultancy from Hamburg with a focus on digital transformation and data protection. The experienced interdisciplinary team supports clients in the conception of legally compliant business models. conreri supports companies in meeting data protection requirements in line with the spirit of the times and jointly develops pragmatic approaches to solutions.
Disclaimer: conreri digital development GmbH has been advising a large number of service providers and associations in Europe for years on the implementation of PUR models. In addition, conreri is committed to their legal conformity, in the sense of service providers and users.