Appropriate fee

At a glance

• “Consent or pay” models must meet the standard for freely given consent. You must be able to demonstrate that people have a free choice to give consent and that they are not unfairly penalised for refusing. You must ensure that people can exercise the right to object to direct marketing, including online personalised advertising, free of charge.
• The level of fee for the ‘pay’ option is a relevant consideration when assessing whether people have freely given their consent. This is because where people are only offered a choice to “consent” or “pay”, an inappropriately high fee may make people feel they have no genuine or free choice but to consent.
• You should assess the appropriateness of any fee to ensure people can provide freely given consent. You should take a reasonable and proportionate approach to this assessment, considering the particular context of your organisation. Thinking about your fee is particularly important where there is a power imbalance between you and people that use your product or service.
• It is not the ICO’s role to set the level of any fee. It is your responsibility to demonstrate that your fee is appropriate. You need to do this in the context of freely given consent for the processing of personal data, in line with the accountability principle under data protection law.
• Your assessment of the appropriateness of any fee could include a range of factors, including consumer valuations of a fee attributed to the avoidance of personal data being processed for the purposes of personalised advertising and the impact of such a fee on different groups.
• If you cannot demonstrate that the level of fee in your “pay” option is appropriate, in the context of data protection law, you must still be able to demonstrate that people can freely give their consent. This could include demonstrating that people can leave your product or service without an unfair penalty or you could offer them alternative options to access your product or service that do not require people to “consent” or “pay”. 

In detail

• Why is an appropriate fee relevant to “consent or pay”? 
• What do you mean by an “appropriate fee”?
• Are pricing decisions about the core product or service the concern of data protection law?
• How do we assess whether the fee is appropriate?
• What methods can we use to assess whether the fee is appropriate? 
• Can we charge for our products and services?
• What if the fee isn’t appropriate?

Why is an appropriate fee relevant to “consent or pay”? 

You must be able to demonstrate that people can freely give their consent to ensure that your “consent or pay” model is lawful. You must also be able to show that people can refuse or withdraw consent without an unfair penalty. 

Under the “pay” option, people are given an option to pay for access and to avoid personalised advertising. You should assess the level of fee of the ‘pay’ option to understand whether people can freely give their consent.

Offering a “pay” option as an alternative to consent does not automatically mean that consent is invalid. A fee does not necessarily result in an unfair penalty to a person. However, if the fee for the “pay” option is set too high, you may struggle to demonstrate that people can freely give their consent. This is because people may be priced out of the “pay” option and feel that they have no genuine or free choice but to consent to personalised advertising. 

You need to think carefully about your fee, especially where there is a clear power imbalance between you and the people using your product or service or access to the service is conditional on people either consenting or paying.

What do you mean by an “appropriate fee”?

In the context of “consent or pay” models and from a data protection perspective, an appropriate fee refers to an amount at which people can freely give their consent. An appropriate fee allows people a genuine choice between consenting to personalised advertising, paying to avoid personalised advertising or (if provided) any further options, such as an option that delivers contextual advertising. 

To allow people to make a genuine and free choice about whether an organisation uses their personal information in this way, an ‘appropriate fee’ means the value that consumers associate with not sharing their personal data for the purposes of personalised advertising.

This is a different and narrower interest than organisations may have when pricing their products and services more generally, where a business is likely to consider wider factors such as: 

• the prices of other products or services;
• people’s willingness to pay for a product or service; and
• the costs of production.

Are pricing decisions about the core product or service the concern of data protection law?

No. It isn’t the ICO’s role to assess or set broader prices or pricing structures, which are commercial decisions for organisations to take. However, under a “consent or pay” model, it is your responsibility to assess the price in the “pay” option to ensure that the fee allows for people to freely give their consent. You can read further details about the core product or service in the equivalence chapter.  

How do we assess whether the fee is appropriate?

You should consider the level of any fee for a “pay” option to support your assessment of whether consent can be freely given. You should set your fee with your organisation’s specific context in mind, considering:

• your size;
• your market position; and 
• the nature of your processing, as well as the other factors set out in this guidance. 

You should assess how appropriate your fee in a proportionate manner and on a case-by-case basis. There is no one-size-fits-all approach. 

What methods can we use to assess whether the fee is appropriate? 

As explained above, your assessment of the level of fee should focus on whether people can freely give their consent to personalised advertising. This should focus on the value that consumers associate with the avoidance of their personal data being used for the purposes of personalised advertising.

In responses to the call for views and wider discussion of “consent or pay” models, we have seen a variety of proposals from organisations about how to set an appropriate fee. Some of these suggested factors may not be relevant to whether people can freely give their consent. For example: 

• Revenue: considering the revenue that an organisation might lose as a result of a reduction in personalised advertising would reflect the value of advertising to organisations rather than the value that consumers associate with avoiding personalised advertising. This seems unlikely to be useful as a measure of whether a fee is appropriate in a data protection context.
• Costs: costs are relevant to an organisation’s pricing decisions and are a typical basis for regulation of service prices. However, they are relevant to organisations and not the value that consumers associate with not sharing their personal data for the purposes of personalised advertising. As a result, costs are unlikely to be useful as a measure of whether a fee is appropriate in a data protection context.
• Consumer valuation of the core service: this is relevant to an organisation’s pricing decisions, including benchmarking against the prices of other services. However, this does not contribute to the value that consumers associate with not sharing their personal data for the purposes of personalised advertising. As a result, this is unlikely to be useful as a measure of whether a fee is appropriate in a data protection context.

The most appropriate measure of whether the level of fee can enable freely given consent is the value that people that use or could use your product or service associate with not sharing their personal information for the purposes of personalised advertising. You should use this measure as a basis to assess the appropriateness of any fee in a “consent or pay” model. 

When considering how to assess the consumer valuation, of not sharing data for the purposes of personalised advertising you could consider the following: 

• Research into your user base. For some organisations, it may be proportionate to rely on existing evidence and research into the consumer valuations of sharing personal information. If you identify a clear power imbalance with the people that use your product or service, you may want to assess the valuation people using your product or service attribute to paying to avoid sharing their personal data for the purposes of personalised advertising.
• Monitoring evidence of both stated (the value people place on protecting their privacy) and revealed preferences (the choices people make to protect their privacy in practice). This would assess people’s ability to act on their stated preferences which may be influenced by harmful design practices as discussed in the privacy by design chapter of this guidance.
• Consider the impact of the fee on different consumer groups and assess whether any will be priced out of the “pay” option or cannot refuse consent without detriment. Where possible, you could consider estimating user income levels to support your assessment as long as this complies with other legal and data protection requirements.

We recognise that estimating these values involves some complexities which you should consider as part of your assessment:

• The value that people associate with not sharing personal data for personalised advertising is highly context-dependent. It can vary by:
  • person;
  • the type of information processed;
  • the type of organisation processing the information; and
  • the processing purposes.
• People’s stated preferences (the value people place on protecting their privacy) are not always consistent with their revealed preferences (the choices people make to protect their privacy in practice).

Can we charge for our products and services?

Yes. The “appropriate fee” factor does not prevent you from charging for your product or service using a subscription model, as part of a contextual advertising model or other funding models. 

However, there are some circumstances that can make it harder to demonstrate that people are freely giving their consent where a “pay” option is the only way to access a service without providing consent to personalised advertising. 

For example, it may be more challenging to demonstrate freely given consent if the fee presented as an alternative to consent combines:

• a fee for access to the core product or service; and
• a fee for not sharing their personal data for the purposes of personalised advertising.

This is because paying a single price which combines these factors may mean that the fee is in appropriately high and can affect whether people can freely give their consent. People may feel they are “priced out” and have no other choice than to consent in order to access the service.

You may still charge for the provision of your products or services, but you should so outside of the alternative to consent. 

For example, an organisation may rely on a model where people must pay a subscription to access a product. They may then seek to introduce a “consent or pay” model on top of the existing subscription (see Figure 1). In this case, an assessment of the appropriate fee should only consider the difference between the fee for the subscription to access the service and the additional fee for the “pay” option where people are choosing to pay to avoid personalised advertising. 

However, if the only alternative to consent is paying a single combined price for access to the core service, no advertising and not sharing personal data for the purposes of personalised advertising, then you may find it more challenging to demonstrate that this is an appropriate fee. It may also be hard to prove that people have freely given their consent. This is particularly the case where there is a clear power imbalance and people may not be able to leave the product or service without being unfairly penalised.

The appropriate fee factor also does not prevent you from offering further subscription options which provide additional features or benefits on top of your “consent” or “pay” options. You may also include additional benefits or features solely to the “pay” option. However, you must not use these extras to justify a higher, inappropriate fee. You should provide at least one option that allows people to access your product or service without personalised ads where the price difference between the “consent” and “pay” option enables people to freely give their consent (see Figure 2).

What if the fee isn’t appropriate?

You must be able to demonstrate that people can freely give their consent. If you cannot demonstrate that your fee is appropriate and allows a genuine and free choice, people may feel pressured to consent to avoid the inappropriate fee. This will make it less likely that they are freely giving their consent. You should take steps to address this, which could include: 

• reconsidering your pricing structure and seeking to provide an option to access the service with an appropriate fee;
• offering an additional option that allows someone to continue to use your core product or service without requiring them to “consent or pay”. For example, an option which allows access to the service and delivers contextual advertising; or
• demonstrating that there’s no clear power imbalance between you and the user. You will need to show that people who choose to leave or not use your service are not unfairly penalised and have a genuine free choice.

You should consider the appropriate fee alongside the other factors set out in this guidance. The fee alone does not automatically determine whether consent is valid. You should still demonstrate that you offer an equivalent service under the consent and pay options. You must meet privacy by design standards.