Meta logo on device screen showing GDPR complaint on withdraw consent

New GDPR Complaint Filed Against Meta by noyb; Company Accused of Ignoring Right to Withdraw Consent With “Privacy Fee”

Meta’s so-called “privacy fee” is its current answer to a string of GDPR complaints that have gradually eliminated its schemes to avoid getting user consent for data collection. Longtime nemesis noyb is back in action with a new complaint, claiming that this new policy violates user rights to withdraw consent under the GDPR’s rules.

The new GDPR complaint centers on the regulation’s stipulation that the means to withdraw consent be “as easy as” the manner in which it was given. noyb notes a clear imbalance here given that one simply clicks to agree when setting up an account, but must then pay at least €9.99/month to avoid tracking or quit using the company’s services altogether.

GDPR complaint takes on Meta subscription scheme for Facebook, Instagram

The so-called privacy fee, which Meta calls a “subscription for no ads,” was announced in late October after a years-long series of attempts to claim exceptions to GDPR consent requirements. Meta essentially tried every exception it had any legal shot at using, eventually seeing them all rejected by regulatory bodies and courts. That prompted the “pay or okay” subscription option late last year, which runs €9.99/month on the web or €12.99/month for mobile device access to the company’s assorted ad-supported services.

noyb’s GDPR complaint asserts this fee makes it impossible for existing service users to withdraw consent without paying. That in turn flies in the face of a GDPR stipulation (found in Article 7) that requires it to be as easy to withdraw consent as it was to initially give it. The noyb complaint also notes that simply paying the fee does not appear to be enough to stop personal information from being used in ad tracking, with a trek through “several windows and banners” required to actively select an option to turn off personalized ads.

noyb further notes that European Data Protection Board (EDPB) guidelines for implementing Article 7 rules specifically point out that requiring a payment to withdraw consent could be considered out of bounds. The GDPR complaint was filed in Austria and requests that the data protection authority order Meta to provide a suitably easy way to withdraw consent and to impose a fine on the company.

This is not the first GDPR complaint the group has filed that is specific to the “pay or okay” fee. In November, shortly after the subscription plan was announced, it filed a separate complaint that addresses the amount of money Meta is asking for user privacy. That complaint (also filed with Austria’s DPA) pointed out that the company derives an estimated €63 per year from personalized ads delivered to each user, yet is asking at least €120 per year for its new subscription fee (and a maximum of €250 per year if the user wants all possible web and mobile services covered).

Case Could Set Precedent for Fees to Withdraw Consent

Though noyb correctly notes that the EDPB has taken a position against payments for privacy in some circumstances, prior guidance from the Austrian DPA does potentially allow for them in others. However, Meta would have to pass tests that it is likely to fail: a company requiring a payment to withdraw consent would have to not be in a monopoly or “quasi-monopoly” position, would have to set a fair price commensurate with what they otherwise expect to make from advertising, and that all other terms of the GDPR must be complied with.

Meta is the first major company to try a “privacy fee” of this sort in the bloc, and the concept has thus not yet been tried in court. The Austrian DPA stands to be the first regulator to take it on, though it will also likely have to refer the case to the Irish DPA given the location of Meta’s EU headquarters. That agency has already taken years in its investigations of Meta’s prior claims of exceptions to GDPR consent requirements, and there is no reason to believe this case would not similarly stretch for a considerable length of time.

Given the Irish DPA’s reputation, noyb has asked the Austrian DPA to initiate an urgency procedure similar to the one recently used by Norway to levy a daily fine against Meta for ad tracking. That would pipeline the issue to the EDPB, but Austria has yet to show any interest in taking this route.

Meta has argued against noyb’s first GDPR complaint by comparing its subscription cost to streaming services like Spotify and YouTube Premium that make removal of ads a key perk. However, there are obvious differences: much of the subscription fee users pay for streaming services goes right back to licensing premium music, TV and movie content that Facebook and Instagram users are not getting. Those services also do not have the same internet-spanning ad networks that Meta has collecting personal data as an incentive to pay to withdraw consent.

noyb has previously warned that a decision in favor of Meta could open the door to a myriad of other apps charging users to withdraw consent. The group cites a study that shows the average mobile phone user  having 35 apps installed, which could collectively cost over €8,800 per year in subscriptions at prices similar to what Meta is asking. A decision against Meta could threaten its position in the EU, forcing it to either finally collect user consent or to pull out of the region entirely. The region is one of its biggest markets, making up about 10% of its total annual ad revenue, and was a growth leader in 2023 with a 35% increase in earnings there.