Meta's “Pay or Consent”: Can You Really Consent If the Alternative Is Paying?

Most people use Facebook or Instagram without thinking too much about what happens to their personal data. The service appears to be free, while the platform makes money from advertising. But behind this apparently simple arrangement lies one of the most difficult questions in the digital economy: how much control should users have over the personal data that helps make these platforms profitable?

The European Union has been trying to answer that question through its digital regulation. One of the most interesting examples is its dispute with Meta over what became known as the “pay or consent” model.

In November 2023, Meta introduced a system for users of Facebook and Instagram in the EU. They could either continue using the services for free with personalised advertising, which involved the combination of personal data, or pay a monthly subscription for an ad-free version. On the surface, this looked like a simple commercial choice. The European Commission, however, considered that something was missing: an equivalent option that used less of the user's personal data.

The case eventually led to a €200 million fine. In April 2025, the Commission found that Meta had breached the Digital Markets Act (DMA), concluding that its model did not provide users with the specific choice required by EU law.

The interesting part of the case is that the European Union was not simply telling Meta that personalised advertising was illegal. It was asking a different question: is a user really being given a meaningful choice over how their data is used?

A choice is not always just a choice

Imagine being presented with two buttons. One allows you to continue using a service for free, but requires the use of your personal data for personalised advertising. The other protects your data more strictly, but costs money.

Legally, that may look like a choice. Economically, however, the two options are not necessarily equivalent.

This is where the DMA becomes particularly interesting. Under Article 5(2), designated gatekeepers such as Meta must obtain users' consent before combining or cross-using certain personal data between their services. If a user does not give that consent, the DMA requires a less personalised but equivalent alternative. The alternative should not simply be a degraded version of the service or make refusing consent unnecessarily difficult.

The Commission therefore approached the problem from the perspective of user autonomy. The issue was not whether Meta could make money from advertising, but whether its market position allowed it to make the use of personal data effectively unavoidable for users who wanted to continue using its services.

This distinction is important because it shows how EU digital regulation is beginning to look beyond the traditional question of whether a company has formally obtained consent. It is also concerned with the circumstances in which that consent is given.

The GDPR is only part of the story

It would be easy to assume that the dispute is simply another data protection case. But the legal picture is more complicated.

The General Data Protection Regulation (GDPR) establishes the main European framework for the protection and processing of personal data. The DMA has a different purpose. It is designed to regulate the behaviour of the largest digital platforms, known as gatekeepers, and to make digital markets fairer and more contestable.

The Meta case shows how these two areas of EU law can interact without being the same thing.

The Commission's 2025 decision was based on the DMA, specifically its rules on the combination and cross-use of personal data. The concern was not simply individual privacy. The accumulation of large amounts of data can also strengthen the position of a dominant digital platform and make it harder for competitors to challenge it.

This is one of the distinctive features of the European approach to digital regulation. Personal data can be both a matter of individual rights and an important economic resource. Regulation therefore increasingly has to consider the two dimensions at the same time.

Why the case matters beyond Meta

The implications go beyond Facebook and Instagram.

For years, many digital business models have relied on a relatively simple exchange: users receive a service, while platforms collect data and generate revenue through targeted advertising. As European digital regulation develops, companies have to consider not only whether individual data-processing activities are lawful, but also how their wider business models interact with rules on competition, market power and consumer choice.

For businesses, this creates a more complicated compliance environment. A business model that is technologically efficient and commercially successful may still have to change if the way it operates gives a gatekeeper an unfair advantage or limits the choices available to users.

The DMA is particularly significant in this respect because it is not simply another set of general rules applying equally to every company. It targets designated gatekeepers and imposes specific obligations on them because of their role in digital markets. Meta is therefore not being regulated in exactly the same way as a small European technology company.

What does “choice” really mean online?

Perhaps the most interesting question raised by the Meta case is also the simplest one: when is a choice genuinely free?

In everyday life, a choice can be influenced by price, convenience or circumstances without necessarily becoming meaningless. Online platforms make this question more complicated because they can control both the service being offered and the way in which the available options are presented.

The European approach increasingly recognises that putting two options on a screen does not automatically make them equivalent. The conditions attached to each option matter as well.

This does not mean that users must always be given a completely free service without personalised advertising. The DMA does not ban personalised advertising. Rather, it requires gatekeepers to provide users with meaningful alternatives where the relevant data-processing rules apply.

Meta has since changed its approach. In December 2025, the Commission announced that Meta would offer EU users a choice between fully personalised advertising using more personal data and an alternative using less personal data with more limited personalised advertising. This new model was introduced in 2026 alongside Meta's existing paid, ad-free option.

The development shows that European digital regulation is not simply about imposing fines after something goes wrong. It can also change the way major digital services are designed and offered to millions of European users.

A broader European experiment

The Meta case forms part of a much wider transformation in the way the European Union regulates the digital economy. The GDPR focuses on personal data and privacy. The DMA addresses the economic power of major digital platforms. The Digital Services Act establishes broader obligations for online platforms and their responsibilities towards users.

These instruments deal with different problems, but together they reflect a broader idea: digital markets should not develop entirely according to the interests of the companies that control them.

That approach can create additional obligations for businesses and make compliance more demanding. At the same time, it reflects an attempt to ensure that technological innovation develops alongside European principles concerning privacy, competition and individual rights.

The Meta case therefore raises a question that is likely to become increasingly important as digital services become more integrated into everyday life. If personal data has economic value, how much control should individuals have over the way that value is created and used?

There may not be a simple answer. But the European Union is increasingly making one thing clear: in the digital economy, offering users a choice is not necessarily enough. The conditions behind that choice can matter just as much as the buttons they are asked to press.