28 April 2024

Dr Ann Kristin Glenster, Executive Director, Glenlead Centre

I have just written a submission for the Minderoo Centre for Technology and Democracy at the University of Cambridge to the Information Commissioner’s Office (ICO) on Meta’s so-called ‘pay or consent’ model. I argue that the European Data Protection Board (EDPB) got it right in its recent Guidelines when it said that the pay model is unlikely to work, in part because personal data should not be treated as a commodity.

In a world of omnipresent surveillance, the EDPB clearly takes a dim view of behavioural advertising, calling it particularly intrusive because, as noted by others, it increasingly relies on sensory, ambient, galvanic, psychometric, and biometric data. Emotional recognition technologies are used in many profiling contexts, yet few of us would like our expressions of sadness or joy to determine which products and services we are offered.

The EDPB is not alone. Others have also called for a ban on behavioural advertising, notably Professor Shoshana Zuboff, author of Surveillance Capitalism. In my view, behavioural advertising and surveillance capitalism are intimately tied to deceptive design and dark patterns. In May 2023, I co-hosted a workshop with Electronic Privacy Information Center (Epic) and the Transatlantic Consumer Dialogue (TACD) on deceptive design as part of the Nobel Prize Summit in Washington D.C. I am thrilled that I will be able to continue to build on this work next academic year (2024-25) as a Carr Fellow in Technology and Human Rights at the Harvard Kennedy School.

I am not surprised to see Meta invent the ‘consent and pay’ model as recent EDPB decisions have left consent as the only possible legal basis for processing for behavioural advertising purposes by large online platforms under the GDPR.

In introducing this new model, Meta is attempting to formalise what for years has been referred to as the oxymoronic ‘free Internet services in exchange for personal data’ model. However, until now, online platforms have had little impetus to formalise this arrangement for all sorts of technical, legal, and economic reasons.

Whether Meta’s latest invention will succeed is still to be seen, but this latest move by the EDPB makes it less likely.

The EDPB’s Guidelines should not only be a warning to Meta but also caution the UK regarding the future of the UK’s GDPR Adequacy status should the ICO choose to take a different approach. This warning should be even stronger given the changes that will be introduced under the Data Protection and Digital Information Bill (DPDI).

In March 2024, the Social Market Foundation published an excellent briefing paper, authored by Alex Lawrence-Archer and Ravi Naik and to which I wrote a foreword, outlining the risks to consumers in the UK should the Bill be adopted. Moving in the opposite direction to the EU, and especially the EDPB, may have wide ranging consequences for consumers, organisations, government agencies, and businesses for years to come. The ICO would be wise to pay heed to their European counterparts as they adopt their own approach to this latest tactic by online platforms. Should the EU get its way, this may signal the end of online behavioural advertising.

You can read my evidence submission here.