The Austrian Federal Administrative Court (BVwG) has confirmed an earlier decision by the Austrian Data Protection Authority (DSB) that the Austrian newspaper DerStandard violated the GDPR when introducing "Pay or Okay”. The DSB and the Court both held that users must be able to selectively consent or object to each processing purpose. This case will now likely hit the Austrian Supreme Administrative Court – and potentially the Court of Justice.
- Court decision (DE)
- on the Complaints
- noyb's "Pay or Okay" Report on the Economics of Online Advertisement
- noyb's FAQs on "Pay or Okay"
Background. DerStandard is the leading liberal newspaper in Austria and was the first website that introduced a so-called "pay or okay" approach when the GDPR came into force. Instead of giving users a "genuine" choice between agreeing and rejecting to online tracking by hundreds of third parties, it asked users to either consent or pay for a monthly subscription, currently priced at € 9,90.
Extreme consent rates. At the same time, only 1-7% of all users want to be tracked for online advertisement if asked openly. However, "pay or okay" gets 99.9% of users to agree to online tracking. If more than 90% of users do not get what they genuinely want, we have everything but a "genuine" choice.
Max Schrems: "We won't rescue online journalism with a couple of cents per month and users through Google Ads. At the same time 'pay or okay' undermines a core pillar of the GDPR - freely given consent. Instead of a genuine choice of users, we get a North-Korean consent rate of 99.9% with this system. Neither DerStandard, nor the authorities can explain how they want to contain this purely political favor to news media – we already see that Instagram and Facebook take the same approach and now charge for fundamental rights."
The DSB decision. In a more political than legal decision, the Austrian Data Protection Authority (DSB) took the view that there was no general issue with "pay or okay" - ignoring the fact that there is a 99.9% consent rate. At the same time the DSB held that DerStandard's approach to "pay or okay" was unlawful as it only allowed a global consent or rejection – when the law requires the option to consent to specific types of processing. DerStandard appealed and argued that such a "granular" consent is not doable in a "pay or okay" system, as it e.g. required tracking and statistics to sell its advertisement in the non-paid version.
Max Schrems: "The DSB decision from 2023 was purely political: they don't want to touch news media, when on other pages even just a gray button in a cookie banner was found to be illegal. Instead of criticizing the overall approach and saying that consent rates of 99.9% show that consent was not 'freely given', they ended up touching upon minor issue. What we have here is a pure 'fake choice' that basically no one wants or uses – just to pretend that users would have an option."
The Court decision. The Austrian Federal Administrative Court (BVwG) now confirmed the DSB decision that DerStandard did not obtain valid consent, rejecting the appeal by the newspaper. At the same time it allowed an appeal to the Supreme Administrative Court (VwGH) given that the issue is novel and not decided by Supreme Courts yet. It is very likely that the Supreme Administrative Court would refer this case to the EU Court of Justice (CJEU).
Max Schrems: "The decision of the Data Protection Authority was simply confirmed, knowing it will most likely go to the Supreme Administrative Court. I guess everyone involved is aware that ‘Pay or Okay’ will have to go to the CJEU."
No abuse of law. DerStandard has also tried to rely on a decision from Belgium claiming that a "model case" by an NGO would be an "abuse of law" and therefore inadmissible. This outlier decision from Belgium was rejected by the Austrian court, who held in line with all other case law in Austria and Germany that "model cases" are admissible and legal.
Max Schrems: "We were surprised that a newspaper tries to suddenly discredit the work of NGOs in front of the courts. We are glad to see that the Court has rejected such ideas. The Belgian decision stays an outlier opinion in Europe."
