In an EU-wide first, Austria’s data protection authority DSB ruled that readers can specifically say ‘yes’ or ‘no’ to cookie paywalls, a widely used model by news media that requires readers to consent to data processing practices or pay for a subscription.
The digital privacy civil rights group NOYB filed a series of complaints against the cookie paywalls of seven German and Austrian news websites in 2021.
The Austrian data protection authority reached a decision on the complaint against the Austrian newspaper derStandard.at at the end of March, NOYB announced on Wednesday (12 April), while the decisions by the German authorities are still pending. The DBS’s decision will now go to the court in Vienna.
SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at, and t-online.de were accused of implementing a ‘pay or okay’ solution. This cookie paywall asks its users to either agree to data sharing with tracking companies or pay for a tracking-free subscription.
“The GDPR requires that consent should be ‘freely given’, meaning that users must have a ‘genuine choice’, which is sometimes interpreted by national authorities as a choice that does not involve data processing,” explained Iacob Gammeltoft Policy Manager at News Media Europe to EURACTIV.
Tracking-free subscription
According to NOYB, the main problem is the disproportionate cost between subscription fees and data sharing.
At the time when NOYB filed the complaint, derStandard.at charged for its tracking-free subscription ‘Pur-Abo’ €96 per year. The civil rights group believes that, in contrast, the outlet would only make a few cents from advertising.
In other words, to NOYB, the subscription option means the newspaper profits off the back of the fundamental right to data protection.
“If we allow that, it will simply cost 10 to 100 times more to insist on one’s fundamental right, we might as well abolish it. It is fascinating that the DSB ignores any claims to this effect,” said Max Schrems, Austrian privacy activist and founder of NOYB.
Publishers, however, have emphasised that media services are journalistic services, and pay-or-cookie walls improve content monetisation and thus fund journalism.
“As private media, press publications are unable to produce and offer professional editorial content without any remuneration,” Ilias Konteas, Executive Director at European Magazine Media Association and European Newspaper Publishers’ Association, told EURACTIV.
“In the longer-term, cookie-or-pay walls can also help publishers overcome their reliance on advertising through new subscription revenues. They can also raise the awareness of audiences about the value of journalistic content and of their personal data,” added Gammeltoft.
The media sector insists that the alternative to cookie-or-pay walls is just paywalls. As a result, high-quality content would be increasingly available only to those with the means and willingness to pay for it, whilst the rest would be stuck with lower-quality content.
“The alternative is to get information from social media, and there can be a lot of fake news,” Andreas Vogel, Managing Director at the WIP Scientific Institute for Press, told EURACTIV.
“I think it is positive. If publishers can’t finance themselves through advertising, they have to make other considerations. It’s actually quite a concession, not just to pay subscriptions but the alternative of data sharing,” he added.
More cases pending
While the Austrian data protection authority (DSB) has reached its decision, German authorities have yet to rule on their cases.
“Austria is the first. Similar decisions by other German authorities are expected to follow in the next few weeks,” a NOYB spokesperson told EURACTIV. There are 16 different data protection authorities in Germany, which adds to the issue’s complexity.
“In the case of Austria, it will go to the next instance, in this case, the Vienna Administrative Court,” the spokesperson said.
The model of pay-or-cookie walls spread rapidly in German-speaking countries and the EU after it was introduced by derStandard.at.
Turning to what this means for the EU landscape, different national data protection authorities have different views on the matter of cookie walls.
While the rights to data protection and privacy are enshrined in the European Charter of Fundamental Rights, they are not absolute rights.
“They must be balanced against other rights, including the freedom to conduct business. That does not mean businesses can do whatever they want, but it has to have a legal value that needs to be part of the discussion,” explains Gammeltoft.
“We believe that this model is permissible under EU data protection law. We are not aware of anything to the contrary,” states Konteas.
Even though the DSB now requires that readers have a genuinely free choice, it remains unclear how it will work together with the tracking-free subscription if users deny their consent to be tracked.
“The technical implementation remains a big question and depends on the decision of the respective authorities,” told a NOYB Spokesperson EURACTIV.
Source : EURACTIV