ICO Advises on Legality of Consent-or-Pay Ad Models
Consent-or-pay advertising models can comply with data protection law if companies can show that people are freely agreeing to have their information used for personalized ads, the U.K. ICO said in guidance issued Monday.
Sign up for a free preview to unlock the rest of this article
Privacy Daily provides accurate coverage of newsworthy developments in data protection legislation, regulation, litigation, and enforcement for privacy professionals responsible for ensuring effective organizational data privacy compliance.
The consent-or-pay model gives users a choice of allowing a business to use their personal information for personalized ads to access a product or service; paying a fee to access the service or product; or deciding not to use the product or service, the watchdog noted.
The model typically prompts users to decide as soon as they visit a website or app via a cookie-like banner. Some models may offer additional choices, such as receiving non-personalized ads or not receiving advertising at all.
If a user opts for personalized ads, the website will target ads based on a profile of the user created by the service, the ICO said. The profile will be based on information intentionally provided, such as age or interests; observed data gathered via tracking or observing the user's online activity; and inferred data -- additional information the service assumes about the user based on the provided or observed information.
Organizations can't use personal information to target users who choose to pay a fee with personalized ads, the ICO added. Users might still see ads selected for relevance based on pages they're viewing, or contextual advertising.
Companies that offer consent or pay can't use consent to cover other uses of personal information not linked to personalized advertising, the ICO said. "Each choice must stand alone."
Users must also have the option to withdraw consent at any time, but that doesn't mean they can then access the site for free, the ICO said. "Our guidance is clear that if you withdraw consent, the organisation can take you back to the original consent or pay choice" for a decision on whether to pay or leave.