3 ms·

> Where has that been ruled legal, and do you have a link to the ruling? This was communicated to me by a law firm specializing this area. This was with regard

> Where has that been ruled legal, and do you have a link to the ruling? This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at". Here's a source in German which includes the ruling as a PDF [1]. I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU. [1] https://www.dataprotect.at/2018/12/07/payortrack-die-entscheidung-der-dsb-nicht-rechtskr%C3%A4ftig/ https://www.dataprotect.at/2018/12/07/payortrack-die-entsche... > If it's really a legit option, it seems like a miracle that nobody else is using this. None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats. And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.

mrmr1993 4y ago
The UK's ICO took a different stance[0] when the Washington Post tried to do this a few years back. For companies that want to do business in the UK, it probably makes sense to follow that more conservative decision. The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): > (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Interestingly, the decision that you linked prefers to rely on the case law of the data protection authority when interpreting the question of consent, in particular referring to rulings that predate the GDPR, despite its refinement of the concept of consent. It also focuses upon 'wesentlicher Nachteil' (significant detriment) where the original text of the GDPR prohibits just 'Nachteil' detriment. I find these choices rather suspicious, and wouldn't be comfortable with relying on them holding if challenged in other EU states. [0]: https://www.theregister.com/2018/11/19/ico_washington_post/ https://www.theregister.com/2018/11/19/ico_washington_post/
- ckastner 4y ago
  Indeed, I overlooked that the ICO took a different stance. I have to admit that I did not research this myself, I just took the word of the (top-tier) law firm back then. > The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): >> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.* I don't see why they should be at odds with the decision? Quoting: "Gibt eine betroffene Person keine Einwilligung ab, so besteht die erste Konsequenz darin, dass diese ein O*-Abo abschließen kann. Dieses O*-Abo ist – wie festgestellt – frei von Werbung, frei von Daten-Tracking und frei von der Setzung von Fremdcookies. Das O*-Abo ist mit einem Preis von 6 Euro monatlich ab dem zweiten Monat auch keine unverhältnismäßig teure Alternative." It's obviously without question that one can charge something for a service rendered -- the newspaper does not have to offer this for free. And in the above text, the authority then opined that charging 6 Euro for a monthly subscription to read a newspaper is not unreasonable, hence the decision to opt into tracking is a free one, because the alternative is simply to pay 6 Euro for a month's access.
  - mrmr1993 4y ago
    Indeed, that is what they decided. However, I still find the interpretation very surprising. The GDPR reads as if its authors had a different understanding. For example, the 'data minimisation' principle indicates that you should not be collecting personal data unless doing so would prevent the desired activity; serving an article, or even serving an article with adverts, can both be achieved without this data. There's also a question over whether the services are the same: a subscription appears to be materially different to one-shot access to an article, a question which is entirely overlooked in their analysis. Beyond the weakening of 'detriment' to 'significant detriment' by reference to their pre-GDPR decisions, I also find the result unusual. The practical interpretation is that, if a user wishes to read 100 articles from 100 service providers all using this scheme, the cost of privacy is a significant detriment at €600. I am not confident that other data protection authorities will be as eager to jump to this same weakened interpretation. There is probably a safer middle ground: giving the user the option to pay for either the article or the subscription, and allowing for either direct payment or payment by proxy through an advertising broker. In the latter context, the user's relationship and data-flow is controlled by the advertising broker, and the service provider needs no data relationship with the user. Of course, this shifts the controller liability into the advertisers -- something that they would probably prefer to avoid -- and I'm not aware of any services offering this or concrete decision on it yet.
jsnell 4y ago
Thanks for the link! > None of the big sites are using it because it's frequently far more profitable to track people. That doesn't explain it. If the only options on accessing one of the "big sites" were to see ads and be tracked, or to pay €200 / year and not be, it is pretty obvious that fewer users would opt out of the tracking than now (when it is free). If a consent dialogue that required one more click for refusing than accepting is not legal, how can this be?
- tzs 4y ago
  One reason that most sites might choose to make their money selling ads over selling subscriptions is that the former is much less of a hassle when it comes to taxes. If your site makes its money selling ads that is most likely only of interest only to the tax authorities where your company is located. It doesn't matter where your site users are located. You advertising income will just be another entry on normal business income taxes. If your site makes its money selling subscriptions, that money is business income on your normal business income taxes but also likely will be subject to sales taxes in the places where your subscribers are located. If you have customers in the EU, you'll need to collect and file quarterly VAT there (the EU has its act together so you only have to register in one country, and file a quarterly report breaking down sales by country, and that one you registered in will deal with distributing the money to the rest). If you have customers in the UK you will have register separately with them, because the morons implementing Brexit failed to arrange to stay in the unified online VAT system of the EU. (Not that you can currently actually register in the UK. We applied for our VAT registration number something like two years ago and they keep saying that HMRC is very busy and will eventually get to it. In the meantime we are suppose to collect and hold UK VAT, but not supposed to call it VAT). If you have customers in the US you might have to deal with sales tax in 45 states. Unlike the EU VAT the rates are not uniform within a given state. You have to deal with different rates in each county, possibly each city, and possibly even in different areas within a city--and tax boundaries do not always line up with zip code boundaries so to do it right you have to collect exact address information for your subscribers.
  - jsnell 4y ago
    These companies already make money directly from consumers all across the EU and would have the processes in place. And again, the point isn't even particularly to make money from selling the subscriptions. It's that if it's legitimate to demand either payment or tracking, then it's trivial for companies to force consent to tracking.
account42 4y ago
I don't speak legalese but your link does not seem to be about any legally binding ruling but simply an interpretation by the data protection agency. It also mentions that users have alternate ways to read the newspaper (offline) so it is not just a choice between paying and tracking.

mrmr1993 4y ago

The UK's ICO took a different stance[0] when the Washington Post tried to do this a few years back. For companies that want to do business in the UK, it probably makes sense to follow that more conservative decision. The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): > (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment. Interestingly, the decision that you linked prefers to rely on the case law of the data protection authority when interpreting the question of consent, in particular referring to rulings that predate the GDPR, despite its refinement of the concept of consent. It also focuses upon 'wesentlicher Nachteil' (significant detriment) where the original text of the GDPR prohibits just 'Nachteil' detriment. I find these choices rather suspicious, and wouldn't be comfortable with relying on them holding if challenged in other EU states. [0]: https://www.theregister.com/2018/11/19/ico_washington_post/ https://www.theregister.com/2018/11/19/ico_washington_post/

ckastner 4y ago
Indeed, I overlooked that the ICO took a different stance. I have to admit that I did not research this myself, I just took the word of the (top-tier) law firm back then. > The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions): >> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.* I don't see why they should be at odds with the decision? Quoting: "Gibt eine betroffene Person keine Einwilligung ab, so besteht die erste Konsequenz darin, dass diese ein O*-Abo abschließen kann. Dieses O*-Abo ist – wie festgestellt – frei von Werbung, frei von Daten-Tracking und frei von der Setzung von Fremdcookies. Das O*-Abo ist mit einem Preis von 6 Euro monatlich ab dem zweiten Monat auch keine unverhältnismäßig teure Alternative." It's obviously without question that one can charge something for a service rendered -- the newspaper does not have to offer this for free. And in the above text, the authority then opined that charging 6 Euro for a monthly subscription to read a newspaper is not unreasonable, hence the decision to opt into tracking is a free one, because the alternative is simply to pay 6 Euro for a month's access.
- mrmr1993 4y ago
  Indeed, that is what they decided. However, I still find the interpretation very surprising. The GDPR reads as if its authors had a different understanding. For example, the 'data minimisation' principle indicates that you should not be collecting personal data unless doing so would prevent the desired activity; serving an article, or even serving an article with adverts, can both be achieved without this data. There's also a question over whether the services are the same: a subscription appears to be materially different to one-shot access to an article, a question which is entirely overlooked in their analysis. Beyond the weakening of 'detriment' to 'significant detriment' by reference to their pre-GDPR decisions, I also find the result unusual. The practical interpretation is that, if a user wishes to read 100 articles from 100 service providers all using this scheme, the cost of privacy is a significant detriment at €600. I am not confident that other data protection authorities will be as eager to jump to this same weakened interpretation. There is probably a safer middle ground: giving the user the option to pay for either the article or the subscription, and allowing for either direct payment or payment by proxy through an advertising broker. In the latter context, the user's relationship and data-flow is controlled by the advertising broker, and the service provider needs no data relationship with the user. Of course, this shifts the controller liability into the advertisers -- something that they would probably prefer to avoid -- and I'm not aware of any services offering this or concrete decision on it yet.

jsnell 4y ago

Thanks for the link! > None of the big sites are using it because it's frequently far more profitable to track people. That doesn't explain it. If the only options on accessing one of the "big sites" were to see ads and be tracked, or to pay €200 / year and not be, it is pretty obvious that fewer users would opt out of the tracking than now (when it is free). If a consent dialogue that required one more click for refusing than accepting is not legal, how can this be?

tzs 4y ago
One reason that most sites might choose to make their money selling ads over selling subscriptions is that the former is much less of a hassle when it comes to taxes. If your site makes its money selling ads that is most likely only of interest only to the tax authorities where your company is located. It doesn't matter where your site users are located. You advertising income will just be another entry on normal business income taxes. If your site makes its money selling subscriptions, that money is business income on your normal business income taxes but also likely will be subject to sales taxes in the places where your subscribers are located. If you have customers in the EU, you'll need to collect and file quarterly VAT there (the EU has its act together so you only have to register in one country, and file a quarterly report breaking down sales by country, and that one you registered in will deal with distributing the money to the rest). If you have customers in the UK you will have register separately with them, because the morons implementing Brexit failed to arrange to stay in the unified online VAT system of the EU. (Not that you can currently actually register in the UK. We applied for our VAT registration number something like two years ago and they keep saying that HMRC is very busy and will eventually get to it. In the meantime we are suppose to collect and hold UK VAT, but not supposed to call it VAT). If you have customers in the US you might have to deal with sales tax in 45 states. Unlike the EU VAT the rates are not uniform within a given state. You have to deal with different rates in each county, possibly each city, and possibly even in different areas within a city--and tax boundaries do not always line up with zip code boundaries so to do it right you have to collect exact address information for your subscribers.
- jsnell 4y ago
  These companies already make money directly from consumers all across the EU and would have the processes in place. And again, the point isn't even particularly to make money from selling the subscriptions. It's that if it's legitimate to demand either payment or tracking, then it's trivial for companies to force consent to tracking.

account42 4y ago

I don't speak legalese but your link does not seem to be about any legally binding ruling but simply an interpretation by the data protection agency. It also mentions that users have alternate ways to read the newspaper (offline) so it is not just a choice between paying and tracking.