Austrian newspaper’s pay or consent model violates EU privacy rules: court

The Austrian Federal Administrative Court on Monday said that newspaper Der Standard violated the EU’s data protection rules when introducing a "pay or OK” model on its website, confirming an earlier decision by Austria’s Data Protection Authority (DSB).

This "pay or OK" approach – introduced on the newspaper’s website when the EU's General Data Protection Regulation (GDPR) came into force in 2018 – gives users a choice between paying a monthly €9,90 fee to access the website without having their data tracked, or giving consent to data collection and processing for targeted advertising. 

The Austrian privacy watchdog already said in its decision in 2023, that the approach of one of Austria's most-read newspapers was unlawful, as it only allowed a global consent or rejection. The EU's privacy law requires the option to consent to specific types of processing.

Der Standard appealed this decision and argued that such a "granular" consent is not doable in a "pay or OK" system, as it required tracking and statistics to sell its advertisement in the non-paid version.

The Austrian Federal Administrative Court now confirmed the data protection decision and ruled that the newspaper did not operate in line with the EU's privacy rules.

Max Schrems, Austrian lawyer and privacy activist at NOYB, said in a statement: "'Pay or OK' undermines a core pillar of the GDPR: freely given consent. Instead of a genuine choice of users, we get a North Korean consent rate of 99.9% with this system.”

NOYB argues that when asked, only 1 to 7% of users want to be tracked for online advertisement. However, with the "pay or OK" model, almost all users will agree to online tracking. 

The court allows an appeal to Austria’s Supreme Administrative Court, making it likely that the country’s highest court will refer the case to the EU Court of Justice. 

In another "pay or OK" case, the European Commission fined Meta €200 million in April for breaching the Digital Markets Act (DMA) with its consent model.

Meta offers users the choice to either pay a subscription fee for an ad-free experience or consent to personalized advertising by allowing the tech giant to track and process their data. 

The Commission said Meta did not "give users the required specific choice to opt for a service that uses less of their personal data but is otherwise equivalent to the ‘personalised ads' service."