Why Pay-Or-Okay remains under GDPR pressure

09-17-2026 - Why Pay-Or-Okay remains under GDPR pressure

Pay with your data or pay with your money. More websites are presenting users with this choice. But can consent still be freely given when refusing personalised advertising comes with a price? 

Why Pay-Or-Okay is back on the agenda 

On 3 June 2026, the Norwegian Consumer Council and NOYB filed a complaint against Schibsted, a major Nordic news publisher. They argue that Schibsted’s Pay-Or-Okay model forces users to accept personalised advertising or pay for access. The Norwegian Data Protection Authority is now investigating whether this model can result in freely given consent. Its decision may offer guidance for publishers and other organisations using similar systems. This blog explains the legal background and sets out practical steps to reduce GDPR risk. 

The Meta case: limited room for alternative legal bases 

The GDPR provides several legal bases for processing personal data. In the Meta case, the Court of Justice found that Meta could not simply rely on its terms of service or legitimate interests to use personal data for personalised advertising. In practice, Meta had to rely mainly on consent. The Court also stated that users must be able to refuse personalised advertising and still access the platform, if necessary for an appropriate fee. Following the judgment, Meta introduced a Pay-Or-Okay model for Facebook in November 2023: users could use the platform for free with personalised ads or pay a monthly subscription for an ad-free experience. 

The EDPB’s Opinion: freely given consent under the GDPR 

Meta’s model attracted criticism from several data protection authorities, as well as the European Data Protection Board. On 17 April 2024, the EDPB adopted Opinion 08/2024 on consent or pay models implemented by large online platforms. The Opinion focuses on whether consent can be considered freely given. The EDPB looks at factors such as detriment, imbalance of power, granularity, conditionality, the availability of an equivalent alternative and whether any fee is appropriate. For large online platforms, a strictly binary choice between consenting to processing of personal data or paying a fee will in most cases make it difficult to demonstrate valid consent. The EDPB thus expects platforms to consider offering a third option: an equivalent free alternative with less intrusive advertising, such as contextual advertising. 

Dutch DPA’s perspective on the third option 

The Dutch Data Protection Authority (AP) supports the EDPB’s position. It emphasises that privacy is a fundamental right and should not depend on whether someone can or wants to pay. The AP considers binary Pay-Or-Okay models undesirable, especially where users feel pressured to accept personalised advertising. At the same time, such models are not automatically prohibited for every organisation. The assessment remains case-specific. Organisations must show that users have a genuine free choice. They must also show that users are not exposed to significant financial or practical pressure. In general, the AP encourages organisations to offer a free alternative that does not rely on personalised advertising. 

The Schibsted case: what changes? 

The Schibsted case may provide more clarity for organisations that are not large online platforms. The key question is whether users of news websites have a real and free choice. Do they freely consent if they must either accept personalised advertising or pay for access? A decision by the Norwegian Data Protection Authority will not automatically bind the AP. It may, however, influence how similar models are assessed in the Netherlands. It could also encourage the EDPB to give clearer guidance for organisations that are not large online platforms. 

Key takeaways for organisations 

Until the Norwegian Data Protection Authority makes a decision or the EDPB provides further guidance, organisations should take the following into account: 

• A Pay-Or-Okay model is not automatically unlawful, but it creates clear GDPR risks. 

• Evaluate whether, and to what extent, consumers may feel compelled to accept personalised advertising. 

• Look beyond payment walls. Practical pressure may also arise when users are steered towards consent through incentives, such as marketing opt-in discounts, vouchers, loyalty benefits or tell-a-friend models. 

• Ensure cookie consent on your website results in freely given consent and also complies with the other requirements of valid consent under the GDPR. 

Would you like to know whether your consent banner or advertising model meets these requirements? Our Privacy team can help with a targeted consent and cookie assessment.