pay or okay - is it really?
While browsing news websites, you may have seen a pop-up like this:
That's one form of how "Pay or Okay" can look like. The model was first introduced by newspapers in Austria and Germany in 2018, but in 2023, Meta adopted it for Instagram and Facebook.
What this means is: Either you agree to the tracking and get to use the website for free, or you disagree to tracking and have to pay.
Maybe this doesn't sound so bad to you; after all, if they lose out on tracking that generates money, they should be compensated, right? Unfortunately, it's not that easy!
You see: Not every Pay or Okay system is set up the same way, or even the way it sounds at first. I wouldn't fault you for thinking that paying should mean there's no tracking at all, or only the most essential tracking and no ads, but that's not true. With many websites like The Guardian above, you pay just to opt out of the ads being personalized. You'll still see ads, you'll still have cookies and "similar technologies" (other tracking) being employed against you. Despite paying monthly, your data is still harvested and your reading behavior tracked.
To me, this is a sort of "double-dipping", as it still results in some data selling on top of my monthly payment. Some research shows that publishers on average earn €0.24 per user and month from personalized tracking and €3.24 per user and month from the paid option1. If I'm going to pay for this and there's increased revenue, I want there to be the minimum amount of tracking, not just less. I don't want you to take my money and still somehow monetize my data!
There are regional differences in pricing too, with the most extreme in France: If you read French online news sites, you'd pay ~800% of the average total digital advertising revenue per user if you wanted to refuse tracking. That means that what you pay and what your data is worth is not equal, they are just milking you on top of it.
Pay or Okay models can, depending on the implementation, lead to a double payment too. You might be paying to be tracked less, and then also need to pay to access paywalled content separately. This tends to happen in setups where it's combined with a freemium model, in which some content is freely accessible while some is paywalled. Even in setups where the paid mode to reduce tracking is just their normal subscription (usually called "hard paywall", or "metered paywall" if you have limited free samples), it means the popup is simply advertisement for their subscription and has little to do with choice.
The sad reality is that instead of empowering users to make a choice, this is once again engaging in dark patterns. Not only is one of the options often automatically pre-selected, higher, or emphasized with colors, but it's obviously easier to just click to agree and be done with it instead of setting up payment first. Research papers about this show that this model leads consent rates of 99% to 99.9%2, even though only 0.16% - 7% of people actually want to be tracked or see personalized advertising online3. This is hardly reconcilable with Article 7(3) GDPR, in which withdrawal or rejection should be as easy as giving consent.
That means: Not only does this put a price on the human right of informational self-determination, but it also makes it a hassle to enforce and stick to as a user.
Another issue is that it's pricing people out of actually getting to make a decision freely. If you struggle financially (or are just a teen with no or little income), it's not worth it to spend money each month just for less tracking - you have bigger problems! If you cannot afford it, you're either forced to agree to the tracking or exit the site.
Even if you pay the fee for one news site, you'd surely not pay it for the handful of others you visit. In Germany, paying the reject fee on 29 of the top 100 websites that used Pay or Okay (including news, weather, ‘social’ media networks and others) amounts to an overall cost of over € 1.528,87 per year according to noyb.eu. That's more than the German yearly spending for clothes. There's also no geographical pricing adjustment, so if you are in an economically weaker country wanting to read German or French news, you'd still have to pay those high prices.
So far, I haven't seen a single site that allows you to pay a rejection fee per article with their Pay or Okay pop-up; it was all or nothing, in a recurring subscription. That's unfortunate, because a user shouldn't have to enter a subscription model to avoid tracking while viewing one article of a site they might not visit again.
This, together with paywalls, is adding to the issue of people increasingly getting their news from third parties that are freely available, but may skew it to their advantage.
Of course independent, investigative journalism needs to be compensated and kept alive. But digital advertising, according to estimates by the European Media Industry Outlook, only accounts for about 10% of the revenue of the press, with targeted advertising being only about 5%. For comparison: Their Figure 50 graphic shows print circulation still makes up roughly 50% of revenue!
Given that on average only 5% of press revenue comes from advertising, implementing Pay or Okay likely only increases the income by very little. This is not enough to save the press, so we should not be misled by economic interests to deny that this has a significant negative impact on our decision to be tracked or not. This doesn't sound like a legitimate (economic) interest that overrides the users' interests according to Article 6(1)(f) GDPR.
Tracking isn't even that useful for news sites: The World Association of News Publishers says that >50 % of global programmatic ('personalized') advertisement spending instead goes to Alibaba, Alphabet, Amazon, ByteDance and Meta. In comparison, news publishers are still taking more directly sold advertisements. That makes sense: The big platforms already work with algorithms and hyper-personalizing the user experience, while news publishers come from a long past of offering people a fixed, non-personalized ad space in the newspaper.
Even if they wanted to use more fitting advertising, there is still the option of contextualized advertising, which are only linked to a specific medium or content without needing to use the users' personal data.
Of course you could say
"Who the hell cares? Just install an ad-blocker and other privacy-focused browser extensions!"
and you'd not be wrong. Allegedly, due to increased blocking or rejection of tracking and cookies, only about 30% of internet users are even exposed to targeting4. I have doubts about this number, because many people do not engage via browsers, but within apps that don't allow interference. But if we believe it, that means even when we have an artificially inflated 99% consent rate due to Pay or Okay pop-ups, most of those don't actually transfer into ad revenue.
Still, there's always an arms race between tracking/advertising and blocking, and we should enable a free choice even for people who aren't knowledgeable enough about this stuff and are still getting tracked without their consent, or forced to.
Caring about privacy in this aspect requires people to know
- how tracking and advertising works
- the negative aspects of advertising (why would you possibly not want it? Not just annoying placement, but possible psychological effects)
- the fact that many of these sites have 100+ (sometimes even 1000+) partners they share the data with
- what data is tracked
- how it can be misused, leaked, etc.
- that ad-blockers and other software exists
- that you can use a browser version instead of the app
and that is a lot! Just imagine telling all of that to your grandparents.
Ask the average person what cookie banners are about; many will not be able to tell you. They are like Terms of Service, Privacy Policies, or EULA's to people. They just know if they click yes, they'll get to where they wanna go faster. There's no informed choice there because many people are not sat down and educated about it, and Pay or Okay pop-ups work the same. I prefer to work on shitty implementations and legal loopholes rather than put the responsibility on the user to know about the latest issues or technical solutions.
Unfortunately, it seems like we are moving on with this.
Despite the European Data Protection Board stating in its 08/2024 opinion that large online platforms relying on a binary choice between consenting or paying a fee is generally not legal, no consequences have followed. Data Protection Authorities, like the ones in Germany, have stayed silent on the matter.
In the Digital Omnibus to overhaul parts of the GDPR and other laws around digital rights, they write:
"Considering the importance of advertising revenue for independent journalism as an indispensable pillar of a democratic society, media service providers as defined in Regulation (EU) 2024/1083 (European Media Freedom Act) should not be obliged to respect such signals."
"Such signals" meaning automated signals of refusing tracking/cookies.
This unfortunately shows that in the future, if this goes through, "Pay or Okay" is seen as acceptable because choice does not matter for news media, even if it was previously (aside from a CJEU judgment in 2023) contentious or denied for large platforms. If it is allowed for one, it should technically be allowed for others, because the GDPR doesn't differentiate between different groups of controllers for these things.
That means a future in which we still continue to fight back against ad-tech, and not just paywalls for content, but paywalls to our right to choose as well.
Reply via email
Published