The controversial business model of “Consent or Pay” flagged for being anti “contestable” under the DMA (Digital Markets Act)
A blog post by Sayantan Dey and Behrang Kianzad
The DMA complements the efforts under the traditional EU Competition Law (i.e. Article 101 and Article 102 TFEU).[1] There is an interplay between EU Competition Law and the DMA.[2]Thus, an analogy has been provided here by drawing reference to a leading case for a simpler contextual understanding of competition law principles. While the DMA’s focus is on digital markets, it has in its compliance grip one of the prominent Gatekeepers[3] (Meta Platforms Inc./Meta) which has crossed the line by violating its Article 5(2) provision.
The European Commission (EC) as an enforcer of DMA in its decision against Meta has considered that the intent of the Regulation which is for creating “contestable and fair market” in the digital market has been vitiated.[4]
Meta´s business model of “consent or pay” has been assailed owing to its different legal hats (roles) viz. the Data Controller[5] , the Gatekeeper [6], and the (very)large “online platform” [7], that it wears requiring adherence to different legal obligations. All these roles that Meta plays have its business model through personal data as commodified or monetized or contractually enabled.[8]
The violation of DMA provision 5(2) has been held to be from 07th March 2024 when the proviso came into force and until 11th November 2024. Thus, the period of noncompliance was for eight months.[9]
The business model of “consent or pay” explained from a general GDPR perspective constitutes providing two( i.e. binary) choices to the data subjects in relation to their access to an online service: either (a) consent to the processing of personal data for a specified purpose, or (b) pay for the services to be availed instead of processing personal data for the same purpose. For the model context, processing in relation to purpose implies behavioural advertising.[10] Payment can be subscription fee payable weekly or monthly, or a onetime payment. The model has its variant for e.g. No pay for few articles and after that pay; presenting content into premium and free types, where the latter gets more traffic.[11]
The model in question is in line with the approved CJEU ruling according to Meta[12], which the EC decided against apart from the core contestability/competition reasons.
The business model pursued by Meta comes under challenge as it is a designated Gatekeeper under DMA which requires adherence to some practices specifically Article 5(2). To understand the competition /contestability issue, we have done an analogy on the similarities of legal concepts raised by EC under DMA for the matter with the traditional competition dominance principles under TFEU 102.[13]
The EC has held:
- The designation of Gatekeeper implies some presumptions like “imbalance of power” coupled with network and lock in effects.[14] It also implies the lack of freedom of choice of the data subjects in relation to the Data Controller from a GDPR perspective.
- Meta has amassed user engagement data over a period of two decades. This allows them to push targeted advertising. so much so to generate 97. 5% of its global revenues.[15]
- Meta´s conduct is negligent and serious, while its impact caters to the entire EU, it is also resourceful being a large undertaking.[16]
- Drawing reference to the EDPB Opinion [17], Meta is both Gatekeeper and Large Online Platform, with the “imbalance of power “contributed by factors like position of Data controller in the market; reliability of the data subject on the service provided by the Data Controller, and the targeted audience of data controller. The audience here as End Users of Meta’s Non -Ad Services forming part of Facebook and Instagram are vulnerable subjects. Thus, this imbalance reduces the negotiating power of such users to any better option other than the only two as provided under this model.
Thus, the dominance part is illustrated with the foregoing reasoning. However, going by the traditional competition principle, dominance should be followed by abusive conduct.
In the context of analogy of abuse of dominance under TFEU 102, Meta’s conduct can be associated with providing unfair trading conditions which are of exploitative nature.
The identical model when explained in the EC DMA decision entails End Users in relation to their personal data: (a)consenting to processing ;and (b) combining their personal data processed from Meta’s Non-Ad Core Platform Services (CPS) with the data in Meta’s Online Advertising service (OAS) CPS.[18] It implies, personalized advertising being pushed to the End Users from OAS, with no charges to be paid for availing services under Meta’s Non-Ad CPS. The other alternative option is to NOT OPT for personalized advertising, but pay subscription fee for availing Meta’s Non-Ad CPS.[19]
In the context of Article 5(2) of DMA, this model is non -compliant on several counts. Upon analysis, it can be said that Article 5(2) requires gatekeeper to not (a) process( personal data of end users which utilize third parties services relying on CPS of the gatekeeper for providing online advertising services), (b) combine( personal data from one cps to that of another cps, or another service of the gatekeeper, or personal data from third party services) , (c) cross use ( personal data from one cps or another of the gatekeeper) , and (d) sign in ( end user into other services of the gatekeeper for combining personal data) end user personal data unless the two conditions are met.[20]
The two conditions are cumulatively applicable and include, in the absence of consent received from end users to the preceding options of (a)/(b)/(c) /(d) :(I)specific choice of less personalized alternative being presented to such end users; and (ii) such end users have consented to that specific choice.[21] On what is less personalized alternative instead of a consent(i.e. originally sought ) has been explained to imply that the impact of which should not make the services offered either different or degrade the quality when compared with the one received under consent. [22] The EC has clarified Meta´s disbelief of vagueness between choice and consent by stating these as two different legal notions.[23]
In this pertinent case, the EC held that Meta has failed in proving both the consent and choice test. Meta failed to provide specific choice to end users to combine or not their personal data from its Non-Ads Services with personal data from its OAS CPS Meta Ads.[24] The consent was vitiated on grounds of imbalance of power and held not to be free. It ought to have met GDPR requirements.[25] Thus, the end users do not have the option to refuse consents without detriment.[26] The detriment of being unfair comes with advertisement or with payment against the end users, which Meta defends under freedom to conduct business.[27] Even the arguments on economic analysis of fair competition with the model benefiting the end users from behavioural advertising because it reduces search costs to find details about products and thereby increasing competition, new entry of players [28], failed to be favourable.
Thus, “consent or pay” model remains controversial for regulatory reasons of privacy and competition, while bringing along intersection of principles on contestability/competition, among others from the two different legal streams.
[1]Recital 10, 11 of Regulation (EU) 2022/1925 of the European Parliament and of the Council of 14 September 2022 on contestable and fair markets in the digital sector and amending Directives (EU) 2019/1937 and (EU) 2020/1828 (Digital Markets Act/DMA)
[2]Noona Jussila and Aylin Özocak, Master Thesis “Regulating Digital Platforms – The Interplay Between EU Competition Law and the Digital Markets Act, 2025
[3]Article 3 of DMA designates certain large digital platforms as Gatekeepers subject to fulfilling certain criteria in the context of EU viz. (a) notable influence in the Internal Market in EU (=> Turnover in EUR 7.5 billion); (b) provider of Core platform services/CPS (only if active monthly end users are approx. 45 million & the platform has 10k annual business users, consistent for the preceding 3 FFYs) etc.
Additional for details, refer Noona Jussila and Aylin Özocak, Master Thesis “Regulating Digital Platforms – The Interplay Between EU Competition Law and the Digital Markets Act, 2025, pg. 12
[4] CASE DMA.100055 – Meta – Article 5(2), Dated 23rd April 2025, Para 36 provides for the intent of DMA which is based on Recital 36,37 which highlights that consolidation of personal data into few or one player decreases competition (contestability).
[5] It is a legal entity under GDPR Article 4(7) which decides what to do with personal data of a data subject (i.e. end user or natural person)
[6] Article 3 of DMA
[7] EDPB Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, Adopted on 17 April 2024, Pg 11
It provides reference to Digital Servies Act where Article 3(I) provides definition of online platforms, but when coupled with the context of large-scale data processing under Article 37 of GDPR, the meaning of (very)large online platforms can be inferred.
[8] Vittorio Bachelet, “Pay or Consent “And Emerging Trends in Digital Contract Law, Pg 3
[9] CASE DMA.100055 – Meta – Article 5(2), Dated 23rd April 2025, Para 308
[10]Advertising that is based on observations of the individuals over time, Article 29 WP Opinion 2/2010, para 19
[11] noyb.eu, Pay or Okay Report, Section 4, Pg 13
[12] CASE DMA.100055 – Meta – Article 5(2), Dated 23rd April 2025, Para 204
Reference to CJEU Rulings: C: 2023:537 & C-252/21
[13] Article 102 TFEU where dominant is one which has a share of around 40% and above in the relevant market share
[14] CASE DMA.100055 – Meta – Article 5(2), Dated 23rd April 2025, Para 183-184
[15] Ibid, Para 4
[16] Ibid, Para 360
[17] Ibid, Para 180-182
[18] The EC decision provides the following CPS of Meta as Gatekeepers: OSN CPS FACEBOOK, OSN CPS INSTAGRAM, OAS CPS META ADS (relevant to the case) and few more.[18]
[19] Para 3 of CASE DMA.100055 – Meta – Article 5(2) Commission Implementing Decision of 23rd April 2025, pursuant to Articles 29(1), point (a), 30(1), point(h) of Regulation EU 2022/1925 of the European Parliament and of the Council on contestable and fair markets in the digital sector
[20] Ibid, Para 55
[21] Ibid
[22] Ibid, Para 37
[23] Ibid, Para 103
[24] Ibid, Para 84
[25] Ibid, Para 178. It provides reference to EDPB ´s Guidelines 05/2020 on consent under GDPR
[26] Ibid, Para 189
[27] Ibid, Para 138 draws reference to Article 16 of the Charter
[28] Ibid, Para 218, 220