Consent or Pay: What You Need to Know

As digital privacy expectations rise and regulations tighten, the consent or pay model has become a focal point for online businesses. This approach gives users a choice: consent to personalised advertising (and data use), pay a fee for privacy, or leave the service.

While it offers a potential solution for balancing user privacy and monetisation, it raises complex legal, ethical, and operational questions.

This article explains what consent or pay means, why it has emerged, what the law, particularly the ICO and EDPB, says about it, and how to implement it in a compliant and user-centric way.

The consent or pay model is a user choice framework that gives individuals three distinct options when accessing a digital service:

• Consent to personal data processing, typically for personalised advertising, in exchange for free access to content or functionality.
• Pay a subscription fee to access the service without any personal data being processed for advertising or tracking purposes.
• Decline to use the service entirely, if neither of the above options is acceptable to the user.

The model appears primarily adopted by digital news publishers.

Key features

• User choice: Empowers individuals to control how their data is used
  
• Revenue diversification: Generates revenue through either ad-based or subscription models
  
• Transparency: Requires clear and honest communication about the options
  

Several key factors led to the rise of the consent or pay model, including:

Regulatory pressure

The General Data Protection Regulation (GDPR) and the UK GDPR require that consent for data processing must be “freely given, specific, informed, and unambiguous.” The Privacy and Electronic Communications Regulations (PECR) set additional requirements for cookies and marketing.

As regulators increase enforcement against non-compliant consent, companies are seeking new compliant monetisation models.

Consumer expectations

Users are more privacy-conscious and expect to be given meaningful control over how their data is used. They are also more likely to reject tracking if it feels unavoidable or forced.

Industry trends

With third-party cookies being phased out and ad blockers becoming more common, traditional advertising models are under strain. Businesses are turning to models like consent or pay to maintain ad revenue while respecting privacy rights.

ICO’s four pillars for consent or pay

The UK’s Information Commissioner’s Office (ICO) published detailed guidance in January 2025. It permits consent or pay under specific conditions:

1. Power imbalance

If a business holds significant market power or the service is essential, consent is unlikely to be freely given.

• Avoid using consent or pay for essential or monopoly services
  
• Take extra care when dealing with children or vulnerable groups
  
• Assess and document your market position
  

2. Appropriate fee

The fee for privacy must be reasonable, not so high that it pressures users into consenting.

• Base the fee on the actual cost of delivering the service without ads
  
• Avoid pricing that feels punitive or exploitative
  
• Be transparent about how the fee is calculated
  

ICO clarification: The fee should reflect “the value consumers associate with not sharing their data”—not company revenue or ad income

3. Equivalence of services

Both the free (ad-supported) and paid (privacy-respecting) services must offer the same functionality.

• Only the presence or absence of personalised ads should differ
  
• Do not add premium features to the paid version
  
• Monitor both experiences for parity over time

4. Privacy by design

The user experience must promote real choice and not manipulate users into consenting.

• Use plain, honest language
  
• Avoid dark patterns (e.g., making the decline button harder to see)
  
• Ensure users can easily change their decision at any time

EDPB’s opinion on consent or pay (2024)

The European Data Protection Board issued its opinion in April 2024, focusing on large online platforms. It applies stricter criteria than the ICO:

Freely given consent

Consent is not valid if users must pay or leave the service to avoid data processing.

• Consent must be free of pressure, detriment, or imbalance
  
• Users must have a meaningful, not just theoretical, choice
  

EDPB emphasis: If users are excluded from “prominent online services” unless they pay or consent, that may constitute unlawful detriment.

Financial barriers and service necessity

High fees or a lack of service alternatives can render consent invalid.

• The more essential the service, the less acceptable it is to charge for privacy
  
• Platforms with market dominance are under greater scrutiny
  

Context matters

The EDPB expects stricter standards for large, essential platforms.

• Avoid applying this model to services with few alternatives
  
• Be especially cautious with vulnerable users
  

Alternatives and equivalence

Paid and ad-supported options must be nearly identical.

• No extra perks in the paid tier
  
• Consider offering contextual ads as a free, non-personalised alternative
  

Transparency and withdrawal

Users must be fully informed and able to change their choice easily.

• Consent must be easy to withdraw
  
• Explain the consequences of each choice clearly and simply

Case-by-case assessment

Organisations are responsible for assessing whether their model is compliant.

• Document decisions, justifications, and risk mitigations
  
• National regulators will evaluate implementations individually
  

To use consent or pay responsibly, businesses should align with both legal frameworks and user expectations.

1. Assess power imbalance

• Determine whether your service is essential or unique.
  
• Avoid deploying the model if users have no realistic alternatives.
  
• Be cautious when your audience includes children or other vulnerable groups.
  

2. Set a fair and transparent fee

• Base the fee on the actual cost of delivering the service
  
• Avoid high fees that discourage users from choosing privacy.
  
• Be open about how the pricing works.
  

3. Ensure service equivalence

• Provide the same core experience regardless of the option selected.
  
• Do not bundle better features, content, or usability into the paid version.
  
• Audit regularly to ensure both experiences remain aligned.
  

4. Design for privacy and clarity

• Use clear, accessible interfaces.
  
• Avoid any design that misleads or nudges users into consenting.
  
• Make it easy to update or withdraw consent at any time.
  

5. Perform a DPIA (Data Protection Impact Assessment)

• A DPIA is mandatory under GDPR when profiling users
  
• It helps assess risks and show due diligence.
  
• Document fee justifications, power dynamics, and user alternatives
  

6. Communicate value and educate users

• Explain the trade-off clearly: how ads support free access.
  
• Provide transparent privacy notices and help guides.
  
• Offer support channels for consent-related queries.
  

Implementing consent or pay comes with challenges:

• User perception: Some may feel pressured or view the model as unfair
  
• Regulatory risk: Poor implementation can attract enforcement
  
• Technical demands: Consent platforms must support clear choice and tracking logs
  
• Market variation: Compliance expectations differ by jurisdiction

The consent or pay model offers a way to reconcile monetisation with rising privacy standards. But it must be handled with care. By following guidance from the ICO and EDPB and implementing best practices, businesses can build models that are legally compliant, ethically sound, and user-centric.

Done right, consent or pay can help you earn trust while preserving revenue. But privacy should never feel like a luxury—it’s a fundamental right.

FAQs on consent or pay