Their new guidance confirms that these models can be legal under data protection law, but only if businesses ensure that user consent is truly “freely given” (which isn’t always easy to prove).

If you operate any form of “consent or pay” in relation to your services you need to ask yourselves these questions: 

– Is there a power imbalance between you and the service user?

– Is the fee fair and value for money?

– Are the paid and free versions genuinely equivalent?

– Is privacy is baked into the design of your service options?

If you can tick all these boxes, you stand a much better chance of demonstrating that your model meets the strict consent rules. The ICO’s guidance can be found here: https://buff.ly/3ENjpBd

The details can be quite complex depending on your circumstances so if you would like our help with interpreting the guidance for you do get in touch.