Thread by @WolfieChristl

So, do the @EU_EDPB's new guidelines on consent approve/endorse an interpretation of the GDPR that permits the 'consent to data harvesting or pay' model? Or don't they?
edpb.europa.eu/sites/edpb/fil…

If yes, wouldn't this mean that every website, mobile app, shop, streaming platform, ISP, airline, scooter rental firm and makers of TV devices, cars, coffee brewers, loudspeakers, vacuum cleaners, light bulbs and door locks could charge additional € for tracking-free versions?

Yes, personal data processing has additional requirements under the GDPR anyway, but still.

I mean, I'm fine with publishers using an 'ads or pay' model.

I'm not okay with personal data exploitation remaining the default, while a minority is paying a hundred times to avoid it.

This is another key part of the EDPB's guidelines on consent related to this question.

So, consent cannot be 'freely given' if refusing to consent leads to 'significant negative consequences' or 'substantial extra costs'. This would still allow 'non-substantial' extra costs.

Based on the guidelines, the real question is what makes negative consequences 'significant'.

Unfortunately, the Austrian DPA decided in 2018 that having to pay €6 a month to a news site to avoid being tracked is not a 'significant' negative consequence.
insideprivacy.com/advertising-ma…

@maxschrems wrote a rebuttal:

"Any company could introduce ‘data transfer or paying’ ...from the mobile phone contract to the train ticket ... people who just have not won the lottery, will probably give their basic rights away 'voluntarily' all the time" noyb.eu/en/pay-or-okay…