What does the term "pay or okay" mean and are such practices permitted?

ANSWER

A distinction should first be made between a paywall and a cookiewall.

In the case of a paywall, the user is required to pay for access to a website. This has nothing to do with cookies and is generally permissible, as any website operator may decide whether access to the content presented on their website should be paid.

This should be distinguished from a cookiewall. With a cookiewall, the user may either pay for access to the website or, alternatively, consent to the use of cookies (typically marketing cookies used to display personalized advertisements). This type of arrangement is commonly referred to as pay or okay, meaning "pay or consent."

The Austrian supervisory authority has recognized the permissibility of the pay or okay model, considering payment for website access to be a lawful alternative to providing consent for the use of cookies (see decision of the Austrian Data Protection Authority DPA-D122.974/0001-DPA/2019).

The Austrian authority's position is supported by the fact that the European legislator also appears to assume that personal data may, at least to some extent, be exchanged in return for access to a service (see Directive (EU) 2019/770, as amended). It should be clearly noted, however, that this is only the interpretation of a supervisory authority, as there is currently no case law from the Court of Justice of the European Union (CJEU) on this issue.

According to the Austrian supervisory authority, the pay or okay model may be used only if the following conditions are met:

• the controller must fully comply with all applicable data protection laws (particularly the GDPR) regarding processing activities that require consent ("okay");
• public authorities may not use the pay or okay model;
• entities with exclusive control over specific content or services, such as public utility companies or providers of universally available services, may not use the pay or okay model;
• entities holding a monopoly or quasi-monopoly position in the market may not use the pay or okay model;
• the fee charged for the paid alternative must be reasonable and fair (the price cannot be unrealistically high);
• where a user chooses the free alternative (i.e., provides consent), personal data may not be processed for the purpose of displaying personalized advertisements.

It is also worth noting that on 19 June 2020, the French Council of State ruled that the French supervisory authority (CNIL) cannot, as a general rule, prohibit the use of cookiewall practices.