”Pay or Okay” — The Move to Paid Subscriptions on Social Networks

Since November 7, European users of Facebook and Instagram have had the option to pay a subscription in exchange for an ad-free experience. Paying to access our social networks? It may seem like a strange idea, but the model is gaining traction.

The ability to use the social network "without ads" will now cost users €12.99 a month (or 9.99 for browser-only use). This option is available to users over 18 from the European Union, Switzerland, Iceland, Norway, and Liechtenstein. Free access remains possible but is conditioned on processing the user's personal data for targeted advertising. Users must consent to Facebook’s use of "messages you send and receive," "metadata about content and messages," "types of content you view," "purchases and other transactions you make," "the time, frequency, and duration of your activities" and "information about the websites you visit or interact with when using our in-app browser" to provide personalized ads. Users who refuse the paid option automatically consent to such processing. Otherwise, they will no longer be able to access the platforms.

Why such a reversal for a social network that proudly displayed on its homepage for years, "free and always will be"? Because the European Commission found Meta's data collection and processing practices illegal under the GDPR. Indeed, until now, the group had not been collecting the "informed consent" (Art. 4) of its users to process their personal data for targeted advertising. Therefore, Meta chose to introduce the subscription as a way to compel its users to consent to invasive data collection or pay up.

Meta’s disingenuous strategy is the result of a long series of legal procedures by the company since the GDPR came into effect in 2018. Initially, the company modified its terms of service on Facebook, stating that processing personal data for targeted advertising was part of its basic features and necessary to provide its services. Indeed, Article 6(1)(b) of the GDPR authorizes processing without consent if it is "necessary for the performance of a contract to which the data subject is party [...]". However, using this contractual necessity as a legal basis for data processing was deemed non-compliant by Irish regulators in January 2023.

Following the 2019 guidelines of the European Data Protection Board (EDPB), which states that the GDPR "doesn’t provide a legal basis for online behavioral advertising simply because this advertising indirectly finances the provision of the service,” the Irish Data Commission condemned Meta's lack of consent collection with a fine of €390 million. The European Court of Justice then definitively invalidated the use of contractual necessity on July 4, 2023 (Case C-252/21 Bundeskartellamt), ruling that the processing of personal data must be subject to specific consent.

Based on this decision, on July 24, 2023, Norwegian authorities imposed on Meta a total ban on targeted advertising in the country. Meta did not comply, so they began imposing the group daily fines of €90,000 in mid-August. On October 27, through an urgent binding decision, the EDPB extended this ban to all the European Economic Area countries, instructing the group to comply with the GDPR, i.e., collecting users’ consent "within two weeks.” In response, Meta deployed its paid option in the following week.

However, the solution is far from satisfying for both regulators and users. It is denounced as a means of circumventing European legislation, particularly because it does not offer an alternative for users wishing to refuse the processing of their personal data but not pay a subscription. Noyb.eu, and 19 European consumer associations have already filed complaints to challenge the model, also known as "Pay or Okay."

While not all platforms have created paid options for the same reasons, their proliferation raises questions as it implies a significant shift in the model offered for online social interactions. Is such a shift legal under EU law, and as important, is it desirable for the paid model to become the norm on our social networks?

Paid subscriptions: a new strategy for social networks

Facebook, Instagram, X, Snapchat, TikTok, and others— the majority of the social networks we use daily— have introduced paid options in recent months. These paid offerings include various premium services, such as account certification, the ability to edit a post, content monetization, and reduced or ad-free experiences. They reflect a revenue diversification strategy pursued by platforms, some of which are still striving for profitability.

The economic model of social networks relies on advertising space sales and users’ data monetization. For instance, in 2022, 98% of Meta's revenue came from ad sales. Social networks operate on a two-sided market with two interdependent actors: users and advertisers. On one side, they offer users an enriched space of expression with personalized content, while on the other side, they sell advertising space to advertisers. The attractiveness of these markets lies in the cross-network effects: the more users there are, the more attractive the platform becomes to advertisers. Platforms also have bilateral market power as they can set the price of their services on both sides of the market. By choosing free access for users, they attract a large audience, enabling them to increase the volume of ad space sales.

The economic model has been lucrative for Meta, but its success is not universal. Despite its popularity, X only turned a profit in 2018 and 2019. Elon Musk, who acquired Twitter in 2022 with the ambition of making it profitable, was among the first to introduce "premium" options, aiming to diversify the platform's revenue. He launched Twitter Blue (later becoming X Premium) in November 2022, offering features such as account certification, tweet editing, and content monetization for $11 a month. In October 2023, X announced two new subscription packages: Basic and Premium + at $3 and $16 per month. Snapchat, experiencing declining revenues (by 4% in the second quarter of 2023), introduced a €3.99 monthly subscription in June 2022, allowing users to test features in "premiere."

As for Meta, whose net income was 23 billion U.S. dollars in 2022, subscription products offer a new revenue stream as its user growth plateaus, if not declines slightly. In February 2023, they launched Meta Verified, a $14.99 per month subscription allowing users to certify their Instagram or Facebook accounts, access dedicated customer support, and benefit from enhanced account protection measures. Initially targeting public figures and content creators (soon to include businesses), this option, inspired by X Premium, aims to boost the group's revenue, which experienced a very slight (1%) but symbolic drop in annual revenue in 2022.

The first major platform to embark on this path was YouTube in 2014, with its YouTube Premium/YouTube Music offering. It has been a success for the platform since it surpassed 80 million subscribers in 2022. YouTube's focus on the music and streaming industry sets it apart from the aforementioned social networks. However, its successful transition likely encouraged X, Snapchat, Meta, and others to follow a similar path.

Subscription models have, thus far, yielded mixed results for YouTube’s social media competitors. X Premium, for example, attracted only 1% of the platform's users. Furthermore, the heavily degraded user experience under the new model caused X to lose 16% of its users and more than 70% of its stock valuation. On the contrary, Snapchat+, offering a relatively attractive €3.99 subscription, reached a significant milestone by surpassing 5 million subscribers in the second quarter of 2023. The difference may lie in the pricing, with Snapchat's offer aligning well with user propensity to pay. Additionally, the application introduced new innovative features and did not turn any previously free options into paid ones. The Meta Verified option has also found an audience. Bank of America analysts estimate that the number of subscribers could exceed 12 million by 2024, generating $1.7 billion in annual revenue for Meta.

The modest successes and the adoption of paid options may encourage platforms to continue down this path. However, it is essential to remember that platforms primarily earn their revenue from selling advertising space, the amount of which depends on their attractiveness, namely the number of users. The balance seems far from tipping. Thus, social networks have a vested interest in attracting and retaining users by maintaining a free model, while opening the door to charging for premium services.

Is Pay or Okay a legal practice?

Is it GDPR-compliant for Meta to offer a subscription as the only option for a user to opt out of personal data processing for targeted advertising? Meta’s business models necessitated that it had to try a “Pay or Okay” strategy. Indeed, mass refusal by users to opt-in to data processing for targeted ads could jeopardize its ad revenues for European users. To avoid such a scenario, Meta conditioned the refusal of data processing on a €12.99 monthly subscription payment. This price is set to encourage the majority of users to click on "use for free" and thus consent to the processing of their personal data.

Meta relied on the Bundeskartellamt decision of the Court of Justice of the European Union (CJEU), which granted the possibility of requesting an “appropriate fee” as an alternative to user data processing. According to the CJEU, the subscription model could represent a “valid form of consent for ad-funded services.”

The CJEU’s decision to allow “Pay or Okay” was not a new approach for European regulators. The Austrian data protection authority had previously confirmed the acceptability of the practice. However, this decision was contested before the Austrian Administrative Court by the nyob association led by Max Schrems, a privacy rights advocate, who emphasized the disproportion between the amounts requested and the actual revenues generated by targeted advertising. Schrems stated, “if we allow fundamental rights to cost 10 to 100 times more than accepting data processing, we might as well abolish our rights.”

In France, the CNIL (National Commission on Informatics and Liberty) stated that cookie walls were not GDPR-compliant. However, the Conseil d’Etat partially invalidated this point, deeming the practice acceptable in the presence of a genuine and fair alternative, and requested CNIL to conduct a case-by-case analysis.

Thus, the practice of “Pay or Okay” (or cookie walls) seems tolerated in the EU, taking advantage of legal ambiguity. However, there are reasons to question its legality since the European Data Protection Board (EDPB) rejected the CJEU interpretation, stating that the payment of a fee “does not constitute an adequate means to ensure user consent.” Firstly, even relying on the CJEU decision, the “reasonableness” of Meta’s subscription price is undoubtedly questionable. The average revenue per user (ARPU) in Europe would be around €6 per month. Thus, how can a monthly subscription of €12.99 be considered reasonable? Subscribing would increase Meta's monthly revenue per user by more than 100%.

The CNIL also emphasized the need to determine a reasonable price to “not [...] deprive internet users of a real choice.” Thus, such a price should correspond to the effective economic loss, which is not the case for Meta's subscription. From regulatory compliance to a business opportunity, there seems to be only a small step. Ultimately, even if the “Pay or Okay” were validated by the CJEU, the requested fee does not seem, in any case, GDPR-compliant.

Moreover, Article 4 of the GDPR defines consent as “any freely given, specific, informed, and unambiguous indication of the data subject's wishes by which he or she, [...] agrees [...] to the processing of personal data concerning him or her.” Specifically, recital 42 of the GDPR states that consent is not freely given if there is no “genuine freedom of choice or [if the individual] is unable to refuse or withdraw consent without detriment.” The freedom of consent in “Pay or Okay” can be easily challenged.

Indeed, what is our freedom when payment of €156 annually is required to refuse the processing of our data? Or when the alternative is to leave a platform that plays a significant social role today? As French lawyer Etienne Wery questions, “Am I giving my consent because I genuinely think it's the right thing to do? Or am I giving it because I don't have the money to pay the subscription, and the sacrifices to be made by renouncing to access my account are such that I am forced to accept?”.

Also, the right to the protection of personal data is a fundamental right guaranteed by Article 8 of the Charter of Fundamental Rights of the European Union. Every European citizen, regardless of their social and financial status, should be able to exercise it. The rights of the most vulnerable will, with this model, be more fragile than those of the wealthier citizens. This fact should once again alert regulators and challenge the legality of “Pay or Okay.”

On November 28, the nyob.eu association filed a GDPR complaint with the Austrian regulatory authority against Meta. On November 30, 19 consumer associations led by the European Consumer Organisation (BEUC) also filed a complaint with European consumer protection authorities. Based on the complaints, Meta's practices, deemed “unfair, deceptive and aggressive under European consumer law”, are likely to be considered non-compliant with directives related to unfair commercial practices and abusive clauses in contracts. A decision against Meta by European authorities could have significant implications for European citizens' (and worldwide users') online privacy protection.

Should we pay for our rights?

The development of paid options is part of a strategy to diversify social network revenues. Built on a free model to attract a broad audience, these platforms are experimenting with new paid features to offer an enhanced experience to willing users, but only for those willing and able to pay. The introduction of paid options also aims to comply with regulatory obligations, such as those related to personal data processing outlined in the GDPR, while avoiding any major changes to social media’s favored targeted advertising model.

However, it's not certain that this shift will be successful. Beyond displeasing users, “Pay or Okay” may not be legal under the GDPR. While the practice currently benefits from legal ambiguity, the spotlight brought by Meta and complaints from privacy and consumer protection groups will likely compel European authorities to settle this point definitively in the coming months or years.

Beyond these legal concerns, “Pay or Okay” raises numerous ethical questions that should prompt us to collectively define what is desirable for our expression and sociability in digital spaces. What forms of subscription are acceptable, and which ones pose risks to the European citizens’ fundamental rights and freedom of expression?

The end of free access to social networks is an “opportunity for renewal” where we could “gain from a societal perspective” by moving from “commodities of the attention economy” to “clients and citizens capable of collectively asserting our conditions” emphasizes, Jean Cattan, President of the French National Digital Council. Yet as a citizen and user, am I satisfied with such a shift? Is it acceptable to create a digital world where the wealthier can afford to protect their personal data while the more vulnerable cannot? Meta's subscription proposal seems to undermine a core principle of equality. The company, for example, could still offer relevant advertising based on the general information it holds about its audience, following the same model as newspapers or television channels. This option would allow retaining a significant portion of its advertising revenue while respecting the GDPR.

Meta and its competitors are commercial entities, so, understandably, they seek to cover the cost of the services they offer and make profits. However, their chosen option, namely paying for the right to privacy, is not in the public interest, especially when regulation compliance turns into financial opportunity.

Max Schrems denounces “Pay for your rights,” reminding us that fundamental rights cannot be sold. By granting the possibility to claim a fee, the CJEU has introduced a problematic inequality in the ability of European citizens to exercise their privacy rights. The processing of personal data for targeted advertising purposes has already resulted in serious threats to democracy, especially through targeted political advertising campaigns (such as highlighted with the Cambridge Analytica scandal). While political ads have since been strictly regulated within the European Union, these incidents highlight the power and potential dangers of targeted advertising. Every European citizen must, therefore, be genuinely able to opt out of it, regardless of whether they can pay.

Furthermore, Facebook’s attempts to undermine the GDPR should lead us to rethink how we want to build our digital social space. Controlled by private actors capable of dictating their rules (and prices), these platforms continue to enjoy unprecedented societal power. In this regard, policymakers should look beyond regulating tech giants and support free and open digital services, such as digital commons or open-source models (e.g. Mastodon, PeerTube, diaspora*, and others) to stimulate innovation and give citizens power over the tools they use daily.