Why Nordic DPAs are pushing European regulators for an emergency stand on pay or OK

Is this about having their cake and eating it too? Norway, Netherlands & Hamburg want European regulators to take a position on “pay or consent” (or “pay or OK” or “pay or data”, however you wish to call it), and the Norwegian data protection authority says in this respect that “it will still be possible to engage in marketing as a source of income” because “more data protection friendly forms of marketing may not require consent at all”.

Unfortunately, the EDPB clearly disagrees with that. It stated publicly that attribution – one of the core elements of even contextual advertising, and used notably with validation techniques for anti-fraud purposes – requires consent under the ePrivacy rules, and it also expanded the ePrivacy cookie rule scope to encompass even the loading of HTML code on a device and server requests that follow.

So no matter what they say on “pay or consent” from the perspective of the GDPR, consent *will* be required for even the most basic forms of advertising – unless the EDPB backs down from its claim that consent is required in those cases (or regulators ignore the EDPB’s position altogether).

A real public debate is needed on this amalgamation of topics: GDPR consent to data processing as an alternative to ad-funded content, on the one hand, and on the other hand ePrivacy rules on cookies and the like and their scope given other technologies traditionally outside of their scope.

If regulators only ever look at one side of the story, they will only create more problems, not solve them.

I know I will be glad to assist companies in preparing legal arguments to dispute this in court if required, but is that really necessary? Couldn’t we just resolve this in a level-headed way?

Link to the Norwegian DPA’s announcement: https://lnkd.in/ezCmTgyX
My op-ed with insights on the legal contradictions and how to handle them: https://lnkd.in/ef2j_3RY (“Op-Ed: Maybe no consent needed for advertising under ePrivacy “cookie” rule?”)