On May 14, 2024, the Spanish data protection authority (AEPD) published an updated guide on the use of cookies to align it with Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms issued by the European Data Protection Board (EDPB) in April 2024. In particular, the guide highlights that the EDPB is expected to issue a General Application Guide on the validity of consent in 'pay or consent' models by the first quarter of 2025.

What does the guide provide?

In light of Opinion 8/2024, the guide highlights concerns that major online platforms may struggle to obtain valid consent if they limit users to a binary choice between consenting to personal data processing for behavioral advertising or paying to opt out. Moreover, the guide underscores the importance of data controllers not defaulting to a payment option for services involving behavioral advertising processing, indicating that when developing an alternative to the version of the service with processing of personal data for behavioral advertising, major online platforms should consider providing the concerned parties with an 'equivalent alternative' that does not involve paying a fee.

If data controllers choose to charge a fee for access to the 'equivalent alternative,' the guidance emphasizes that they must also consider offering another free alternative without behavioral advertising, which could be considered equivalent in principle. This alternative, the EDPB adds, could consist of general or contextual advertising. In other words, advertising that requires the processing of fewer or no personal data of the recipient, such as being based on a selection of topics chosen by the subject from a list of interests provided by the platform. The guidance highlights that this option stems from the principle of data minimization, which requires data controllers to ensure that only necessary data for advertising activity will be processed. Offering this free alternative is a particularly important factor in assessing whether the consent given for behavioral advertising would be considered valid and whether detriment to the concerned party has occurred.

You can read the updated guide, only available in Spanish, here.