Pay or consent: Meta got slapped with a € 200 non-compliance fine—but the real story is what comes next. The Commission’s Article 5(2) decision could rewrite the future of behavioral advertising. Curious how this will reshape Meta’s business model? Dive into our latest blog for the full story.
By Team SCiDA
Meta’s “pay or consent” model violates the DMA. On 23 April 2025, the European Commission filed its non-compliance decision and handed down a fine of EUR 200 million. This fine might be pocket change for Meta’s multi-billion-dollar business, but the decision carries weight far beyond the amount. It signals nothing less than the end of Meta’s personal ads business as we know it.
The reality of “pay or consent”: less than 1 % paid subscribers
Meta is among the largest companies on the planet based on market capitalization. Where does its financial success come from? The answer is simple: personalised advertising. In fact, 97,5% of Meta’s global revenue stems from its advertising business. The DMA imposes restrictions on the usage of personal data for advertising. Article 5(2) of the DMA prohibits the combination of user’s personal data from different services, which is crucial for Meta’s behavioral ads business. In order to continue its detailed profiling based on data combined from different sources, Meta needs to rely on the exception under Article 5(2): data combination is prohibited “unless the end user has been presented with the specific choice and has given consent within the meaning of [the GDPR]”.
Meta’s “pay or consent” model tried to make use of that exception by providing its users with a binary choice: either consent to our data processing and continue to use our services for free (“consent”) or pay a monthly subscription fee of 10-13 € per month (“pay”). But does this provide users with an actual choice between two equivalent services, as required by the DMA? No, according to the European Commission (EC). And also on this blog, we estimated last year that virtually no end user would opt for the paid subscription. The non-compliance decision reveals compelling evidence of the imbalance of the “pay or consent” model: less than 1% (!) of Facebook and Instagram users have opted for the subscription model.
Not just Consent: the DMA demands a real Alternative
In its decision, the EC has found that Meta’s “pay or consent” model does not satisfy the two conditions of the exception in Article 5(2): it neither provides the specific choice of a less-personalised equivalent service, nor does it enable users to give their valid consent.
Meta disagrees with the ECs view that the exception under Article 5(2) includes two separate and cumulative conditions: firstly, the provision of “the specific choice” and secondly valid consent of the GDPR. For Meta, the mentioning of a “specific choice” merely refers to the condition of “specific” consent under the GDPR (para 45) and should not serve as a distinct condition. Why does it matter? For the EC, “the specific choice” serves as a gateway to activate the conditions mentioned in Recital 36 and 37 of the DMA and allows it to interpret them independently from any GDPR considerations and the CJEU’s judgement in Meta vs Bundeskartellamt (C‑252/21). According to the Commission, “specific choice” is an autonomous notion that is distinct to the DMA and must be interpreted as such (paras 103 et seq.).
To provide this specific choice, the EC expects Meta to fulfill the requirements of Recitals 36 and 37 DMA: offer a less personalised but equivalent alternative which does not rely on the combination of personal data (para 87). The equivalence of the alternative should mean that it is not different or of degraded quality unless the degradation of quality is a direct consequence of the limited data processing (Recital 37 DMA). On 14 pages, the EC explains, why Meta’s subscription version is not equivalent to its ad-funded option. Central to the EC’s argumentation is the difference in conditions of access (para 92). Paying a fee is a different access condition than entering a service free of charge. A subscription model entails a monetary burden and includes a payment process that is more complicated than pressing “I consent”. Therefore, for the EC, the two models represent two different means of renumerating Meta for access to the service, which excludes equivalence. This means the Commission expects that any option provided to end users under Article 5(2) as an alternative to consenting must be based on the same means of renumeration. If Meta’s service based on personalised ads is free of charge, so must the equivalent alternative. It seems, the Commission has taken a narrow view on what equivalence means. Based on the condition in Recital 37 DMA, which says that the less personalised alternative “should not be different”, the Commission develops the requirement that the alternative must not only be equivalent but basically equal to the personalised version (apart from the lower degree of personalisation).
Didn’t the CJEU leave the door open for a subscription model?
Do you remember the famous CJEU decision in Meta vs. Bundeskartellamt (C‑252/21)? In the judgement’s Recital 150, the court stated: “[non-consenting] users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations” (emphasis added). Of course, Meta argued that the Court specifically invited Meta to establish a subscription model as an alternative for non-consenting users.
The EC rejected such arguments based on the fact, that the CJEU decision only concerns the interpretation of the GDPR and not Article 5(2) DMA. This is probably the reason why the EC insisted that the specific choice of a less-personalised but otherwise equivalent alternative is a condition which is distinct and specific to the DMA. Consequently, the requirements of the DMA go further than the ones of the GDPR and the CJEU’s judgement doesn’t save the “pay or consent” model from being non-compliant.
But the EC also prepares itself for arguments claiming the CJEU decision should be applied after all. It argues that the words “if necessary for an appropriate fee” do not entitle data controllers to charge a monetary fee for the less-personalised alternative. Based on different linguistic versions of the CJEU decision, the EC understands “fee” in a broader sense as some kind of “consideration” or “compensation” which does not necessarily have to be monetary. Therefore, the EC takes the view, that even if consideration could be appropriate, Meta would need to assess whether it can be renumerated in a different manner other than being paid directly by its end users (para 108). This argument differs from the EDPB opinion on “pay or consent” models (08/2024). The EDPB also argued against the imposition of a subscription fee, however it rather focused on the words “if necessary” and “appropriate” to explain that a subscription fee would need to be assessed on a case-by-case basis.
Regarding the first criterion of Article 5(2), the specific choice, the Commission concludes that a subscription option is not equivalent to the version funded by personal ads and therefore, Meta is in breach of the DMA.
Freely given Consent: where DMA and GDPR overlap
The EC also assesses the second condition for combining data under Article 5(2): valid consent. Here, there is no doubt that consent has to be interpreted according to the GDPR. Therefore, the EC cooperated with the Irish Data Protection Commission and followed the EDPB guidance on “pay or consent” models.
Valid consent under the GDPR must be given freely. And here, the EC (following the EDPB) sees significant problems with Meta’s “pay or consent” model. Because of the striking imbalance of power between Meta and its users, and the existence of network and lock-in effects, the end users are likely to suffer a detriment when not consenting to the data processing. The EC explains that in the past, Meta has attracted users who might now have the willingness or ability to pay a fee but who now have come to rely on Meta’s free services for their daily lives. Here, the EC’s findings might sound like an episode of Black Mirror, but they are actually describing reality: for many people there is no life without social media usage and the digital social infrastructure of social networks has become indispensable for them (para 198). This came as a welcome reminder of the ruling of the German Federal Court of Justice in the Meta case in 2020, when it stated that “user access to the social network Facebook determines participation in social life to a considerable extent, at least for some users, so that they cannot be required to do without it” (para. 102 of case KVR 69/19).
Consequently, users’ consent to data combination would not be given freely, if their only alternative is to pay a monthly fee. The EC follows to a large part the EDPB opinion and concludes that in case of Meta, the “pay or consent” model does not satisfy the requirements for freely given consent. Therefore, also regarding the second condition for data combination under Article 5(2) DMA, the EC finds Meta to be non-compliant.
Too big to be fined?
The non-compliance fine was set to EUR 200 million. This sum was seen as surprisingly low by some. Yes, the decision is among the first DMA non-compliance proceedings (which was considered a mitigating factor) and it only sanctions the period of March-November 2024 (medium duration). However, the gravity of non-compliance could be seen as severe, as the EC finds that the model rolled out by Meta “was never intended to comply” with the DMA (para 318). Meta’s internal documents reveal that its estimations of the take up rate for the subscription model were very close to the actual take up rate of below 1 % (para 97). This seems like a planned violation of the DMA by Meta in order protect its highly lucrative business model based on personalised ads.
As the Commission states itself, it “must ensure that fines have a sufficiently deterrent effect in relation to Meta, but also in relation to other designated gatekeepers to avoid future breaches” (para 336). However, the EC’s fine setting does not reflect that.The revenues Meta made from behavioral ads in the period of non-compliance largely exceed the EUR 200 million fine. If the EC continues to set fines like that and not to take into account the benefits of non-compliance for Gatekeepers, then breaching the DMA becomes a rational choice and the threat of regulatory sanctions loses its deterrent effect.
And indeed, it’s not looking good for deterrence: Euronews reports that the EC is not planning to impose periodic penalty payments after the 60 days implementation period. Additionally, the WSJ reports the EC would be stalling DMA enforcement as part of a trade deal with the Trump administration. It remains to be seen how the EC proceeds. Remember that national authorities cannot step in (EC as sole enforcer) and private enforcement remains a tough, er, cookie.
New Name, old Game: Meta’s new option is still non-compliant
So, Meta’s “pay or consent” model does not comply with the DMA. What now? In November 2024, Meta had proposed a new alternative in addition to the original and the subscription option: the free, less-personalised alternative with mandatory ad breaks (Additional Ads option). This new alternative was explicitly not subject of the EC’s non-compliance decision and yet the decision reveals valuable insights on why the new model is unlikely to be DMA-compliant.
In the justification for announcing periodic penalty payments, the EC had to assess whether the new Additional Ads option had brought Meta‘s non-compliance to an end. It takes the EC two paragraphs to analyze the new consent flow and to find significant shortcomings for valid consent, such as pre-selected boxes. For a visualized analysis of the consent flow under the new Additional Ads option, see our previous blog post. According to the EC, “for these reasons alone it cannot be excluded that Meta’s Additional Ads option does not comply with this Decision” (para 373).
But also independent of the choice screen design, the new Additional Ads option is unlikely to comply with the DMA. As described above, the EC has chosen a strict approach regarding the equivalence requirement. If a difference in access conditions is already enough for the EC to find the alternative to be “different or of degraded quality”, then mandatory ad breaks are unlikely to make the Commission happy. They directly disturb the user experience on the platform and degrade the quality of service. Consequently, we expect the EC to mandate Meta to let go of the mandatory ad breaks in order to become compliant with Article 5(2).
Interestingly, Meta seems fully aware of what needs to be done for full compliance. The non-compliance decision mentions a proposal by Meta of 6 March 2024, one day before the initial DMA compliance deadline. This proposal included an “alternative less-personalised advertisement offering” which is different from the Additional Ads option, and which was never rolled out (para 316). The decision does not mention the content of the proposal, but the EC states that the proposal shows that “Meta was therefore aware early on what steps it would have to take to comply with Article 5(2)” (para 316). Meta referred to this proposal in its response to the EC’s preliminary findings and stated: “Meta has gone as far as to indicate to the EC that it would be willing to consider an alternative compliance solution that addressed the EC’s concerns” (decision footnote 212).
The (less profitable) Future of Meta’s Ads Business
It seems that Meta will have to go back to this proposal to satisfy the EC’s expectations of compliance with Article 5(2). So how could Meta’s ads business look in the future?
As mentioned in the cease-and-desist order (paras 363 et seq.), Meta’s new alternative offer needs to fulfill the following requirements:
- it cannot include personalised advertising based on data combination covered by Article 5(2),
- it must be equivalent to the original service with personalised ads, e.g. in terms of performance, experience and conditions of access,
- specifically, it cannot involve a fee, as long as the original version is provided for free.
Meta’s new offer therefore likely has to be based on non-personalised general ads, contextual ads or ads personalised based on topics of interest specifically selected by the end-user, as proposed by the EDPB (cf. para 75, EDPB Opinion 08/2024). Regarding contextual ads, however, Meta should assess diligently to what extent the “context” of the social media feed is already personalised and tailored to a given user. As we explained in our previous blog post, personalisation based on social media context can lead to much stronger personalisation than one might expect. If the contextual data on Facebook and Instagram is so personalised that it can be qualified as personal data, then its usage for Meta Ads would also amount to a combination of personal data from different services, prohibited under Article 5(2).
No matter the specific design of the DMA-compliant version of Meta’s services, it will severely affect its ads revenue. And Meta is preparing for that. In its latest investor report, Meta states: “we expect we will need to make some modifications to our model, which could result in […] a significant impact to our European business and revenue as early as the third quarter of 2025.”
Five years ago, when the Bundeskartellamt ran its legendary case against Facebook that led to the DMA, one of our SCiDA researchers said: The German antitrust watchdog “hit the heart of the business model”. The German case never got to a final stage. But now, the heart is bleeding.
Meta’s statement to investors confirms: the DMA will be the end of its personalised ads business as we know it – at least in Europe. How will Meta react with the lower profitability of its ads business? The company’s announcement to start placing ads on WhatsApp might be the first indication on where things are headed.
If you do not want to miss any of our future blog posts, you can subscribe to the SCiDA-Newsletter here.
