The first EU Digital Markets Act fines were finalized 24 April, as the European Commission issued long-discussed fines to Apple and Meta totaling 700 million euros. The Commission's 200 million-euro penalty against Meta keyed in on the company's highly-debated pay-or-consent practices, charging EU users for ad-free services.
Mere hours after the news broke, a panel of leading European data protection regulators took the stage at the IAPP Global Privacy Summit 2025 for a pre-planned discussion on the implications of pay-or-consent models, which has been in scope for regulators in recent years under data protection law.
France's data protection authority, the Commission nationale de l'informatique et des libertés, Commissioner Bertrand du Marais told GPS25 attendees that the Commission's decision may show large companies' dominant position in the digital market "reduces the options from the data subject point of view" as it relates to making free and informed consent decisions.
The decision
According to the Commission, an investigation found Meta "did not give users the required specific choice to opt for a service that uses less of their personal data but is otherwise equivalent to the ‘personalised ads' service."
Additionally, the Commission alleged Meta's plan "did not allow users to exercise their right to freely consent to the combination of their personal data."
In a statement, European Commission Executive Vice-President for Tech Sovereignty, Security and Democracy Henna Virkkunen said organizations must provide individuals with the right to control how their data is used without asking consumers to pay the company to prevent data processing.
"The decisions adopted today finds that both Apple and Meta have taken away this free choice from their users and are required to change their behaviour," Virkkunen said. "We have a duty to protect the rights of citizens and innovative businesses in Europe, and I am fully committed to this objective."
Meta Chief Global Affairs Officer Joel Kaplan issued a response to the Commission's final decision, noting the Commission sought to "handicap" Meta and similar U.S.-based businesses while noting European consumers and businesses will suffer from personalized advertising limitations.
"This isn't just about a fine," Kaplan said. "The Commission forcing us to change our business model effectively imposes a multi-billion-dollar tariff on Meta while requiring us to offer an inferior service."
EU enforcement views
Meta's pay-or-consent model has faced regulatory challenges across the EU with the European Data Protection Board previously issuing its opinion stating the practice did not comply with EU consent standard. The EDPB argued large platforms may not be able to obtain valid consent when users are faced with the choice of paying for their personal data to not be processed for behavioral advertising.
The focus on the advertising technology industry's data collection and processing standards is largely due to the potential for companies to collect extensive amounts of personal data through online advertising. Du Marais said adtech's influence impacts a wide variety of consumers as its offerings are "disseminated all over our society, in all countries and all social classes in all ages."
Ireland Data Protection Commissioner Des Hogan suggested DPAs take a values-based approach when looking to regulate adtech's obligations under digital regulations, particularly the EU General Data Protection Regulation. Hogan said regulators "recognize that businesses have a right to conduct their business and to have consistency and predictability."
Hogan added the goal is getting to a place "where there is an easily understood curve, where companies can bring products and services to the market" without consistent enforcement actions.
Du Marais noted despite concerns that the Commission's decisions are targeting U.S.-based companies, enforcement against U.S. platforms "is not an aggressive decision," but "purely a logical consequence of the combination" of extensive data collection and the economic impact of the advertising industry.
UK ICO's perspective
The U.K. Information Commissioner's Office released broad guidance on pay-or-consent models detailing the mechanisms used in the digital landscape. The guidance indicated the models may not comply with obligations that require consent to be freely given.
The ICO added organizations must ensure data collection options are provided to consumers, acknowledging the "power balance" which could force individuals to opt in to data collection when they need to use an online service.
At GPS 2025, ICO Executive Director, Regulatory Risk, Stephen Almond said organizations should assess their methods of obtaining consent and determine whether they are providing consumers with a "really clear statement" of their choices. Companies must also ensure individuals are given fair choices when opting out of data collection.
"It's going to be no good if you're saying, 'Hey, you can pay $1,000 for this super-duper privacy extra thing that has all these extra bells and whistles tagged on, or you can consent to this low value kind of experience," Almond said. "You've got to make sure that the choices that you're getting people are equivalent."
Almond added while the Commission and the EDPB has focused its pay or consent efforts toward Meta, "these are models that many organizations right now are considering big or small, and we're really trying to make sure that people have got the clarity on how to introduce those lawfully."
Lexie White is a staff writer for the IAPP.
