Note: This article is part of the Cyber Law and Policy article series, authored by Zachary Smith.
(Photo generated by CanvaAI)
Background
The Digital Markets Act (DMA) is a new regulation in the European Union (EU) that focuses on privacy and user rights in digital marketplaces. The DMA allows the EU to impose rules and fines on large digital platforms called “gatekeepers.” The European Commission is the executive branch that implements laws for the EU. The Commission broadly decides which platforms are gatekeepers. Large corporations such as Meta, Amazon, and Apple are subject to the DMA as gatekeepers.
The DMA is joining the already comprehensive General Data Protection Regulation (GDPR) to enforce privacy and security standards across the EU. The GDPR has stringent requirements concerning how companies manage user’s data. Meta faced several disputes under the GDPR in 2023, such as a $414 million fine from the EU in January for forcing users to accept personalized ads. They were fined another $1.3 billion in May for transferring user data from Europe to the U.S. These GDPR penalties are a part of the EU’s focus on regulating tech platforms, further empowered under the DMA, to inhibit their ability to collect and sell users’s data for advertising revenue. Advertising makes up a substantial 97% of Meta’s total revenue.
In response to these regulatory developments, Meta created a subscription model that allows EU citizens to opt out of targeted ads for €9.99 ($10.78). Customers have two options: use Meta’s services for free while having data collected for targeted advertising or pay a monthly fee to keep your data private. Meta publicly stated in a press release that advertising models allow anyone to access online services for free and are the “cornerstone” for an inclusive internet.
Despite Meta’s subscription option, several international actors believe Meta is violating people’s human rights. For example, noyb, an Austrian-based non-profit that advocates for data privacy as a human right, lodges lawsuits against actors to advance GDPR’s influence. noyb litigated the previously mentioned $414 million lawsuit against Meta from January 2023. Actors favoring powerful data protection rights believe that Meta is simply circumventing EU privacy laws rather than offering EU citizens a good-faith option to consent to their data being collected. noyb claims that Meta’s subscription model violates Article 7 of the GDPR, which requires consent to be as easy to withdraw as it is to provide.
Discussion
The GDPR and the DMA have cemented the EU as the polestar of privacy regulations in the tech industry. Meta has long touted advertising as the linchpin to a free and open internet, but the European Commission and its allies have spent considerable effort in opposition to the advertising model. The passage of the DMA has empowered the EU and plaintiffs wanting to file lawsuits against digital platforms more than ever before.
The GDPR Art. 7(3) dictates that withdrawing consent from data collection must be as easy as giving consent. noyb believes Meta’s subscription model violates the GDPR and the DMA because of the inconsistency between providing and withdrawing consent. They contest that paying €251.88 ($271.68) a year to withdraw consent is not as easy as clicking an accept button to consent. However, this position from noyb seems untenable for Meta and its ability to operate in Europe.
Since Meta currently makes most of its profits from advertising and advertising is no longer an option under the GDPR, it would need a new revenue model. If the European Commission decides Meta must provide a free option to withdraw consent, then it is likely that most users will opt out of advertising, radically reducing Meta’s profits. This outcome leaves Meta with little recourse because it would eliminate advertisement and subscription revenue.
Many supporters of the GDPR, such as noyb, believe that this restrictive regulatory outcome is necessary and that technology companies should adapt their models to respect privacy as a human right. The EU has pushed for digital rights with GDPR for several years, but the DMA has empowered regulators and emboldened plaintiffs to sue companies such as Meta.
Under the GDPR and DMA, there are three potential paths for how technology companies can operate. First, large tech platforms could maintain the status quo where they provide free services but track user data for targeted advertising. The second path is the current model Meta has implemented in Europe, where users can decide between being tracked or paying a monthly fee to use Meta’s services without being tracked. The third option is a privacy-centric digital marketplace where platforms will be burdened with restrictive regulatory guardrails that leave little room for disagreement with the EU’s data policies.
The first option has obvious issues concerning the need for more options for users who value their privacy. Platforms such as X and Facebook harvest a substantial amount of data from users without an option to pay a fee or opt out of their data being collected. This status quo has motivated many actors across the globe to begin pursuing alternatives for digital rights, most significantly seen in the GDPR and DMA.
However, those adamantly fighting for privacy need to focus on public sentiment, which is not clearly in favor of potentially paying more for currently free services. Simon-Kucher published a study in 2022 that found that the public is experiencing significant subscription fatigue, with a third of users reporting canceling a subscription within the following year. Notably, the study found that over half of these users would reconsider cancelation if their monthly fee was lowered and advertising was implemented to shift the cost. The reality is that people enjoy and benefit from services such as YouTube, Facebook, X, and Instagram being free because of their advertising revenue models. Although privacy might be necessary to users, the issue of subscription fatigue is a hurdle for privacy advocates wanting to redistribute the cost of large tech platforms.
The second option is the most moderate model, giving consumers a choice between privacy and free use. This option is depicted by the current situation in the EU, where Meta offers an ad-free subscription or free access to its services in return for user data. This model pleases both types of users, where those concerned with privacy can directly pay for services and maintain their anonymity. Conversely, users not concerned with being tracked can continue to access platforms free of charge. Despite this moderate path that offers users a choice in their data being collected, there are still concerns with the fairness of subscription models.
This second option’s freedom of choice between paying a subscription for privacy or trading data for free use hinges on a critical factor: wealth. There is an implicit issue in this option that ensures that the less wealthy a person is, the less likely they are to pay for their privacy. Class-based filtering could occur where wealthier segments of the population could readily step out from the trepidations of extensive data harvesting, leaving historically underprivileged individuals to be the sole focus of aggressive advertising methods. In Privacy Rights and Public Families, Khiara Bridges similarly argues that people “easily” barter away their privacy when faced with potential costs. Furthermore, Bridges contends that “wealth is a condition of possibility for rights.” In Bridges’ view, those with fewer means will bear the brunt of data harvesting.
Although these class concerns are substantial, they do not defeat the public policy benefits of Meta’s current proposition for the EU. As discussed earlier, option one offers privacy-conscious users no recourse to insulate themselves from intrusive tracking practices. Option two’s subscription model is a critical improvement because it allows people to prioritize their data but raises class-based concerns. To combat the issues under the status quo and Meta’s current solution, privacy-forward actors are pursuing a third option.
The final option is what noyb and like-minded parties advocate: a strict restructuring of American tech platforms. This third path for tech platforms is troubling because it is cloaked in ambiguity, where regulators possess vast powers in the digital ecosystem. noyb’s response to Meta’s subscription model shows what this privacy-forward option would look like in practice, where a platform like Facebook can neither rely on tracking users’ data for advertising nor implement subscriptions in place of advertising revenue. This option is purely privacy-focused. noyb’s interpretation of Art. 7(3) of the GDPR that withdrawing consent must be as easy as providing consent is the legal rationale for this strict regulatory burden being placed on large technology companies. Privacy advocates who support this privacy-focused option believe that the issues from the previous two options discussed above are untenable and that the public should never have to pay for privacy.
noyb and other actors advocating for strict privacy rights could be suggesting that advertising can continue on Meta and other platforms as untargeted ads rather than targeted ads. Untargeted advertising would be a return to form for the ad market, requiring advertising agencies to find other methods to reach consumers other than using vast troves of data to send highly targeted ads. noyb has not directly stated this as a potential option for Meta and other digital platforms, nor is it clear that companies would pay as much for untargeted ads. A study from Accenture, the Accenture Pulse Check, indicates that 91% of consumers are more likely to shop with a brand that provides relevant offers and recommendations. Furthermore, that same study found that 83% of consumers are willing to share their data for a personalized experience. Even if Meta can employ untargeted advertising to replace the current personalized market, businesses will likely pay far less for digital platforms to advertise because untargeted ads are less effective. Therefore, Meta and other large tech platforms will still have to overhaul their revenue model to comply with the strict standards advocated by noyb and other privacy-forward actors in the EU.
noyb’s position that Meta can no longer track users for advertising revenue nor offer a subscription model leaves tech companies in a precarious position in the EU, where the future of their industry must radically change into a format that overvalues privacy. noyb’s claim against Meta, filed in late 2023, is testing its strict interpretation of the GDPR and the DMA.
Despite these restrictive regulations, platforms like Facebook and X will likely continue providing services to the 448 million people in the EU. US lawmakers have become increasingly inclined to question digital platforms considering new legislation over the last several years, such as regulations that seek to protect children from predators online. State actors are becoming more inclined to regulate digital platforms for many essential reasons. The status quo for digital platforms is likely to vanish, leaving the proposition for users to choose between the more moderate subscription approach offered by Meta or noyb’s privacy-centric path. This is only one aspect that users need to consider in the endlessly shifting digital landscape.
The Internet is an inherently international construct defined by various state actors’ laws and policies. Anyone studying digital law and policy must rapidly familiarize themselves with the strict regulatory regimes being adopted in the EU. The GDPR and the DMA’s new gatekeeper regulations are examples of the shifts in the global digital ecosystem that could transform the internet. Considering the progression of the EU’s regulatory actions, questions about whether such regulations are conducive to creating the best internet are becoming moot. Instead, the question is rapidly becoming: how will platforms adapt to an already restructured internet, and what does that mean for users across the globe?
