Austrian court: Der Standard broke GDPR with pay-or-consent model
The Austrian Federal Administrative Court confirmed that newspaper Der Standard breached the EU’s data protection rules by using a “pay or OK” consent model on its website. Under this system, users were asked to either pay a monthly fee of €9.90 for an ad-free, non-tracked experience or give global consent to tracking and targeted advertising. Austria’s Data Protection Authority (DSB) had already ruled the model unlawful in 2023 because it only offered a binary choice rather than permitting consent to specific types of processing as required by the GDPR.
Der Standard argued that granular consent was impractical for a “pay or OK” model, claiming that tracking and aggregated statistics were necessary to sell advertising for the free version. The court rejected this rationale and upheld the DSB’s finding that the paper’s approach did not meet GDPR standards. The ruling emphasizes that consent must be freely given, specific, and offer genuine alternatives without coercion through payment or other pressure.
Privacy advocates, including Max Schrems of NOYB, criticized the “pay or OK” model as undermining the core principle of freely given consent, noting that the scheme produces extremely high consent rates that do not reflect genuine user choice. NOYB points to surveys indicating only 1–7% of users would choose tracking when given a real choice, yet “pay or OK” structures result in near-universal consent to tracking.
The Federal Administrative Court’s decision can be appealed to Austria’s Supreme Administrative Court, which may refer the matter to the Court of Justice of the European Union for a definitive interpretation. Similar scrutiny has occurred elsewhere: the European Commission fined Meta €200 million in April for a comparable consent model that failed to provide users with specific, equivalent alternatives that process less personal data.
