The Federal Administrative Court of Austria (Bundesverwaltungsgericht) has recently issued a judgment clarifying the conditions under which the “Pay or Okay” model is compliant with the GDPR. The Court concluded that the model implemented by an online daily newspaper was not in line with the General Data Protection Regulation (“GDPR”), as it did not ensure freely given consent of the data subjects.
This judgment further elaborates the standards for data processing based on consent, which are of particular importance for media outlets and online platforms relying on cookies for advertising and analytics purposes.
What is the “Pay or Okay” Model?
The “Pay or Okay” model provides website users with two options: either to consent to the use of cookies for advertising and analytics purposes, or to pay a subscription fee in order to access content without advertisements.
We have previously written about the “Pay or Okay” model and the positions of European institutions on its lawfulness in our articles on the guidelines of the European Data Protection Board and the limits of applying the “Pay or Okay” principle in practice.
In the case of the Austrian daily newspaper that used this model on its website, the user chose not to pay the subscription and accepted cookies but regularly deleted their history because they did not want to be tracked. Believing that they had been forced to consent to data processing, the user lodged a complaint with the Austrian Data Protection Authority (“DPA”).
The data controller, on the other hand, argued that data processing for advertising purposes was necessary for the provision of its services, and also pointed out that the “Pay or Okay” model had already been approved in previous decisions of the DPA.
Proceedings Before the DPA
The Austrian DPA found the “Pay or Okay” model unlawful in this form, as it implied consent to all processing operations collectively, without the possibility of choice. The user was forced into an “all or nothing” scenario – either consent to all processing or pay the subscription fee. Such an approach was considered incompatible with the core GDPR principles of lawfulness, fairness, and transparency, while consent given in this manner was deemed to be “conditional”.
The DPA ordered the deletion of the user’s personal data but dismissed the user’s request to impose a ban on further processing. Both the controller and the user appealed this decision, bringing the case before the Austrian Federal Administrative Court.
Decision of the Austrian Federal Administrative Court
The Austrian court upheld the key findings of the DPA. First, the judgment emphasized that recording consent preferences through a so-called TC string constitutes the processing of personal data within the meaning of the GDPR.
The court rejected the controller’s argument that the processing fell within the scope of the “media exemption”. The use of cookies for advertising and analytics purposes does not constitute journalistic activity and does not contribute to freedom of information, even if it indirectly finances journalism.
The most important part of the ruling concerns the validity of consent as a legal basis for processing in such cases. The court held that a data subject must be able to decide for which specific purposes they give consent, rather than being forced to accept all processing operations collectively. This view is consistent with the Guidelines of the European Data Protection Board (“EDPB”), which emphasize that in “Pay or Okay” models, users must be able to choose individual purposes of processing.
Finally, the court confirmed that the DPA was not obliged to impose a processing ban, since the user does not have the right to demand a specific legal remedy, but only the protection of their rights under the GDPR.
Impact of the Judgment on Practice in the EU and Serbia
The Austrian ruling confirms that consent for data processing must be specific and purpose-based. An “all-or-nothing” approach, such as that found in the “Pay or Okay” model, does not meet the GDPR standards. It remains to be seen how this judgment will influence the practice of other national supervisory authorities and courts across the EU, but it certainly represents an important step in strengthening user rights and more clearly defining the boundaries of valid consent.
For controllers in Serbia, the decision is a signal that domestic practice will, following the EU model, move toward a stricter interpretation of valid consent. This means that models combining advertising and subscriptions will need to be carefully designed in order to ensure genuine freedom of choice for users.
Sonja Stojčić, Senior Associate
sonja.stojcic@prlegal.rs; legal@prlegal.rs;