Will websites charge you to reject their cookies?

Image for article titled Some EU websites charge you to reject cookies - US could be next

Photo: Zsolt Biczo / Shutterstock.com (Shutterstock)

On your first visit to the website of The SpiegelGermany’s leading online news source, you have the choice: buy a monthly subscription for €4.99 or give up your data.

T-Online, Bild, Die Welt and a variety of other news sites offer the same choice. Want private browsing? Cough or kick rocks. The new privacy headache popping up in some central European countries has been dubbed a “cookie paywall,” and it could make web browsing very expensive.

You’ve probably seen websites that require you to accept or reject cookies before viewing content. A paywall cookie creates a bigger roadblock, forcing you to pay to avoid tracking. This feature is a way for online businesses to try to navigate European privacy rules and stay profitable. Incognito mode can’t get you out of this one. With a US federal privacy law on the horizonExpensive cookie paywalls could also be a sight of the future for the American internet, if regulators aren’t careful.

“It’s a win-win for websites. They get paid with data or they get paid with money,” said Cristiana Santos, assistant professor of privacy and data protection law at Utrecht University and co-author of a next article. research paper (PDF) examining cookie paywalls: “Your consent is worth 75 euros per year – Measurement and legality of cookie paywalls.” The paper will be presented at the 2022 Workshop on Privacy in the Electronic Society in November.

Santos and his co-authors analyzed websites across central Europe. Although they remain rare, researchers have registered a number of them among the 13 most popular news sites in Austria and Germany.

Santos and his company have also found privacy to be costly. The document documents how it would cost €728 per year (about $706) to avoid tracking on just these 13 websites. When researchers checked Der Standard, an Austrian newspaper, it cost €75 a year to avoid tracking on this website alone. Would you pay for your privacy site by site? How much would you pay?

The cookie popups that have begun to plague web browsing in Europe and the United States are already full of dark patterns, design tips that nudge or nudge you into making a decision you might not otherwise choose. In fact, even when you manage to make an effort to protect your privacy, you may not succeed. When you say no to cookies, a lot of websites follow you anyway. The cookie paywall takes this to its logical extreme: forget the design tricks, they force the issue by involving your wallet.

People value their privacy, and some people are shelling out for tools like virtual private networks (VPNs) to protect it. But for the typical consumer, personal data has never held much value. A study 2020 from the Technology Policy Institute found that most people would trade almost any aspect of their online privacy for less than $10. When it comes to choosing between data and subscription fees, most people will probably choose to save money.

“As only a tiny minority would pay these fees on a large number of digital services, data mining would become the default for most Europeans,” said Wolfie Christl, a researcher who studies the data industry. “I hope regulators, courts and policymakers recognize this threat and put an end to it.”

The General Data Protection Regulation (GDPR), Europe’s privacy law, requires companies to obtain your consent before collecting and processing your data. The law states that consent is meant to be “freely given”, but there is ample room for interpretation that regulators in Austria and France have ruled that the paywall cookie model is not manifestly illegal. So far, the European Data Protection Board, which oversees GDPR enforcement in the EU, has not weighed in.

Currently paid cookies are not common in the United States. There are no general privacy laws at the federal level, and even the most stringent state privacy laws do not require companies to obtain permission before tracking you. They are only obligated to give you a way to unsubscribe. Most consumers don’t care, so it’s still easy for companies to monetize your data, but that could change.

“These U.S. opt-out requirements don’t create as much pressure or incentive for companies to move to a ‘consent-or-pay’ model,” said Christine Lyon, global co-head of privacy and security data within the law firm Freshfields. If stronger federal privacy laws are passed, paid cookies could come to America, Lyon said.

When privacy comes at a price, the brief history of the web indicates that most people don’t pull out their credit card to protect their data. This lax approach could undermine the whole purpose of laws like the GDPR.

Compelling people to give up their privacy with a financial penalty does not constitute meaningful, freely given consent, said Santos, co-author of the research. “We have been able to see this practice spread and be legitimized. The business model here can certainly be replicated.


Comments are closed.