Wiki · Concept · Last reviewed June 16, 2026

Consent or Pay

Consent or pay is a consent-interface and business model in which a user is asked to accept personal-data processing, often behavioral advertising, cross-service tracking, or profiling, or pay for an alternative version of the service. The governance question is whether the choice is a real expression of consent or a priced path out of surveillance.

Category: Concept Published: June 16, 2026 Modified: June 16, 2026 Last reviewed: June 16, 2026 Tags: Privacy, Consent, Advertising, DMA, GDPR, AI Governance

Definition

Consent or pay, sometimes called pay or okay, is a model in which access to a digital service is conditioned on one of two choices: consent to a specified use of personal data, or pay a fee for an alternative that avoids that use. In the most contested version, the data use is behavioral advertising, cross-site tracking, cross-service data combination, profiling, or data reuse for personalization.

The term is not the same as an ordinary subscription. A newspaper may charge for journalism without making privacy the object of exchange. Consent or pay becomes a governance problem when privacy-invasive processing is the free path and payment is the refusal path, especially for a dominant, socially important, or hard-to-leave service. The question is whether the resulting consent is meaningfully free, specific, informed, granular, and reversible, or whether the interface turns dependency into permission.

The issue sits between Data Minimization, Contextual Integrity, Deceptive Design Patterns, Real-Time Bidding, and Platform Governance. It is increasingly relevant to AI because model training, personalization, memory, recommender ranking, and agent connectors all rely on interface choices that can be framed as consent.

How It Works

A consent-or-pay flow usually appears at the boundary of access: a cookie banner, account prompt, app screen, privacy center, or subscription page. The service offers one path that permits data-intensive personalization or advertising and another path that requires payment, reduced functionality, or a different service tier. The design details matter: price, wording, defaults, number of clicks, prominence of refusal, ease of withdrawal, and whether the paid alternative is genuinely equivalent.

For advertising platforms, the economic logic is direct. Behavioral advertising and measurement can be more valuable than contextual advertising. If the user refuses tracking, the service may claim it needs subscription revenue to replace lost ad value. The governance dispute is not whether services may earn money. It is whether payment can be used to manufacture valid consent for processing that is not necessary to provide the core service.

Current Context

As of June 16, 2026, the most developed public regulatory record is in Europe. The European Data Protection Board's Opinion 08/2024 addressed consent-or-pay models implemented by large online platforms. It emphasized that controllers must meet all GDPR consent requirements and stated that, in most cases, large platforms will not be able to satisfy valid-consent requirements if users are given only a binary choice between behavioral-advertising consent and payment.

The Court of Justice of the European Union's 2023 Meta Platforms v Bundeskartellamt judgment is part of the background. The Court said users who refuse processing not necessary for the contract should be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such processing. That language does not make every fee lawful; it makes equivalence, necessity, dominance, and price part of the analysis.

The Digital Markets Act made the issue operational for gatekeepers. On April 23, 2025, the European Commission announced a non-compliance decision finding Meta's binary consent-or-pay advertising model for Facebook and Instagram non-compliant with the DMA and imposing a EUR 200 million fine. The Commission said Meta breached the obligation to give consumers the choice of a service using less personal data. Meta appealed the decision, and the Commission's 2026 DMA review says it is still assessing the practical impact and uptake of Meta's later less-personalised ads choice, presented to users by the end of January 2026. Current claims should therefore distinguish the 2025 finding, the 2025-2026 remedial offer, and any final assessment of that offer.

The UK Information Commissioner's Office takes a more conditional position for UK online tracking. Its January 2025 guidance says consent-or-pay models can be compliant if organisations can demonstrate freely given consent and meet legal requirements. It tells organisations to assess power imbalance, appropriate fee, equivalence, and privacy by design, and to document that assessment in a data protection impact assessment. The ICO also marks the guidance as under review after the Data (Use and Access) Act came into law on June 19, 2025, so UK claims should be dated and checked against the current ICO page.

The EDPB and European Commission are also building joint DMA-GDPR guidance. Their October 2025 public-consultation draft explained that Article 5(2) DMA requires both a specific choice of a less personalised but equivalent alternative and valid consent under the GDPR for covered data combination, cross-use, advertising, or sign-in practices. A March 2026 Commission update said final joint guidelines were expected in the last quarter of 2026.

Governance and Safety

Consent or pay tests the boundary between choice and coercion. If a service is socially necessary, professionally necessary, or hard to replace because of network effects, paying to refuse tracking may burden privacy as a luxury good. If the fee is high, the consent path may become economically forced. If the alternative is degraded, the choice may be formal but not substantive.

Children, teens, low-income users, workers, patients, students, and people who need a dominant platform for social or professional life deserve stricter review. For them, a paid refusal path can function less like a market offer and more like an exclusionary condition on privacy.

The AI-era version extends beyond cookies. Users may be asked to allow model training, assistant memory, product personalization, voice retention, workplace telemetry, data enrichment, or agent access in exchange for free service, lower price, better ranking, or convenience. A consent button can authorize a data pipeline whose later uses are difficult to see, contest, or reverse.

Governance should treat consent-or-pay as a full product system, not only a banner. Reviewers need the price, the alternative service, the advertising stack, the consent text, the refusal path, the withdrawal path, the downstream vendors, the children's or vulnerable-user setting, and the data flows after the click. A compliant-looking first screen can still fail if withdrawal is hidden, the paid option is bundled with unrelated perks, or the less-personalised version still relies on data combination that requires separate consent.

For AI systems, the strongest rule is separation. Consent for advertising should not silently authorize training reuse, saved memory, model improvement, companion personalization, ranking experiments, data brokerage, or agent connectors. Each high-impact reuse needs its own purpose, legal basis, retention rule, deletion pathway, and evidence that refusal does not punish the user beyond the loss of the optional feature.

Defense Pattern

Offer a real alternative. Refusal should not make the service unusable where the processing is not necessary.
Use contextual ads where possible. Less invasive revenue models should be considered before behavioral tracking is treated as essential.
Assess price and power. Document whether the fee is appropriate for the audience, service dependency, market power, and realistic ability to leave.
Keep the core service equivalent. Do not degrade refusal paths except where degradation directly follows from not using the refused data.
Make withdrawal symmetric. Revoking consent should be as easy as giving it.
Document necessity. Controllers should explain which processing is necessary for the service and which is optional.
Test the full interface. Regulators and auditors should inspect wording, timing, defaults, mobile flows, accessibility, and downstream vendor signals.
Separate AI reuse. Consent for advertising, personalization, training, memory, and agent access should not collapse into one vague acceptance.

Assessment Checklist

A review should answer these questions before treating consent as valid:

Processing purpose: What exact data use is being consented to: behavioral ads, cross-service combination, AI training, memory, ranking, measurement, or vendor sharing?
Necessity: Which processing is necessary for the core service, and which is optional monetization or personalization?
Alternative: Is there an equivalent, less-personalised or contextual-ads path that does not require payment, and if not, why not?
Price and power: Is the fee appropriate for the audience, market power, service dependency, lock-in, and likely exclusion of low-income users?
Granularity: Can users consent separately to advertising, measurement, training reuse, saved memory, recommendation ranking, and third-party disclosure?
Withdrawal: Is revocation as easy as acceptance, and does it stop downstream processing, vendor signals, saved profiles, and AI reuse?
Evidence: Are screen versions, A/B tests, prices, DPIAs, consent logs, withdrawal logs, vendor contracts, and data-flow maps retained for audit?

The checklist should be run on the full service, not a screenshot. Consent can fail through price, lock-in, interface asymmetry, bundled purposes, degraded alternatives, or data flows that continue after refusal.

Source Discipline

Consent-or-pay claims need jurisdiction, authority type, date, service, and processing purpose. An EDPB opinion about large online platforms under the GDPR is not the same as UK ICO guidance for UK publishers, a DMA non-compliance decision for a designated gatekeeper, or a consumer-protection claim about deceptive design.

Separate binary models from three-option or less-personalised alternatives. A source about Meta's November 2023 model, its November 2024 revision, or the January 2026 less-personalised ads choice may not apply to another platform, a small publisher, a subscription news product, or a child-directed service.

For factual claims, cite the actual regulator, court, statute, or published company commitment. Advocacy-group analysis, law-firm commentary, and news coverage can help explain stakes, but they should not carry the factual weight of a claim that a model is unlawful, compliant, fined, appealed, or still under assessment.

For product evidence, preserve the user journey: jurisdiction, account state, device, language, date, price, screen sequence, defaults, available alternatives, withdrawal path, and what data flows after each choice. Consent records without the interface context are weak evidence.

Spiralist Reading

Consent or pay is the tollbooth version of privacy.

The user is told they are free because two doors appear. One door opens by surrendering data. The other opens by spending money. The institutional question is not whether a person clicked. It is who built the hallway, who priced the exit, and who keeps the record of permission afterward.

Open Questions

When is a paid privacy alternative equivalent enough to support valid consent?
How should regulators measure dependency, lock-in, and network effects in consent design?
Should AI training, memory, and personalization require separate choices from advertising consent?
Can small publishers use consent-or-pay models differently from gatekeeper platforms?
What fee turns a privacy-protective alternative into an unrealistic choice?
How should users prove that a later data use exceeded the original choice?

Sources

European Data Protection Board, Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, April 17, 2024.
European Data Protection Board, Opinion 08/2024 PDF, April 17, 2024.
European Data Protection Board, EDPB: 'Consent or Pay' models should offer real choice, April 17, 2024.
European Data Protection Board, Guidelines 05/2020 on consent under Regulation 2016/679, May 4, 2020.
European Commission, Commission finds Apple and Meta in breach of the Digital Markets Act, April 23, 2025.
European Commission Press Corner, Commission finds Apple and Meta in breach of the Digital Markets Act, April 23, 2025.
European Commission, Meta commits to give EU users choice on personalised ads under Digital Markets Act, December 8, 2025.
European Commission, DMA Review Commission Staff Working Document, April 28, 2026.
Court of Justice of the European Union, Judgment in Case C-252/21, Meta Platforms and Others v Bundeskartellamt, July 4, 2023.
European Commission, About the Digital Markets Act, reviewed June 16, 2026.
European Commission, DMA designated gatekeepers, reviewed June 16, 2026.
European Commission and European Data Protection Board, Consultation on joint guidelines on the interplay between DMA and GDPR, October 9, 2025.
European Data Protection Board and European Commission, Commission and EDPB publish contributions to the consultation on draft joint guidelines on the interplay between DMA and GDPR, March 12, 2026.
UK Information Commissioner's Office, Consent or Pay: About this guidance, January 23, 2025; under review following the Data (Use and Access) Act; reviewed June 16, 2026.
Federal Trade Commission, Bringing Dark Patterns to Light, September 2022.
Church of Spiralism internal background, Deceptive Design Patterns and Contextual Integrity, reviewed June 16, 2026.

Return to Wiki