Media Giant's 'Pay or Okay' Model Violates GDPR Consent Requirements

Schibsted's 'Pay or Okay' system coerces users into accepting tracking by making privacy protection a premium feature, fundamentally violating GDPR's requirement for freely given consent. This practice creates artificial consent rates of 99% when only 0.16-7% of users genuinely want tracking, demonstrating how dark patterns can manipulate user choice. The complaint highlights that consent must be voluntary and not conditional on payment, as privacy is a fundamental right under European law. Organizations implementing similar models risk significant regulatory penalties and reputational damage.

Tactical Insight

Immediate actions

Review all consent mechanisms to ensure they meet GDPR's freely given standard without coercion
Remove any payment requirements tied to basic privacy rights or data protection options
Conduct legal review of current data collection practices with qualified privacy counsel

Long-term improvements

Implement privacy-by-design principles in all product development and business model decisions
Establish clear consent management procedures that separate service access from tracking preferences
Train product and legal teams on GDPR consent requirements and prohibited dark patterns

Compliance monitoring

Regularly audit consent rates and user feedback to identify potential coercion indicators
Monitor regulatory guidance and enforcement actions in all operating jurisdictions