The eagerly-awaited guidance by the European Data Protection Board, EDPB, has now been postponed until May. In the meantime, discussions have ramped up amongst business, DPAs and privacy advocates. While businesses say this is not a new phenomenon and that they need to fund their services, DPAs have voiced concerns.

The debate on behavioural advertising started in earnest last year. Norway’s DPA, the Datatilsynet had already placed an interim ban on Meta’s data processing in July 2023. In November 2023, the EDPB issued a binding decision which banned the processing of personal data for behavioural advertising purposes on the basis of contract and legitimate interest(1). This is where the “pay or consent” term came in. An EDPB taskforce is now deliberating on this topic and is expected to issue guidance in May after the Norwegian, Dutch and Hamburg DPAs requested a binding EDPB opinion on the matter. It is expected that the Opinion will address this business model more generally than just the Meta case.