> None of the big sites are using it because it's frequently far more profitable to track people.
That doesn't explain it. If the only options on accessing one of the "big sites" were to see ads and be tracked, or to pay €200 / year and not be, it is pretty obvious that fewer users would opt out of the tracking than now (when it is free).
If a consent dialogue that required one more click for refusing than accepting is not legal, how can this be?
If your site makes its money selling ads that is most likely only of interest only to the tax authorities where your company is located. It doesn't matter where your site users are located. You advertising income will just be another entry on normal business income taxes.
If your site makes its money selling subscriptions, that money is business income on your normal business income taxes but also likely will be subject to sales taxes in the places where your subscribers are located.
If you have customers in the EU, you'll need to collect and file quarterly VAT there (the EU has its act together so you only have to register in one country, and file a quarterly report breaking down sales by country, and that one you registered in will deal with distributing the money to the rest).
If you have customers in the UK you will have register separately with them, because the morons implementing Brexit failed to arrange to stay in the unified online VAT system of the EU. (Not that you can currently actually register in the UK. We applied for our VAT registration number something like two years ago and they keep saying that HMRC is very busy and will eventually get to it. In the meantime we are suppose to collect and hold UK VAT, but not supposed to call it VAT).
If you have customers in the US you might have to deal with sales tax in 45 states. Unlike the EU VAT the rates are not uniform within a given state. You have to deal with different rates in each county, possibly each city, and possibly even in different areas within a city--and tax boundaries do not always line up with zip code boundaries so to do it right you have to collect exact address information for your subscribers.
In the derstandard.at model, the site is inaccessible (and also does not set any cookies, or perform any other tracking options) until you choose either A or B, so the amount of clicks are the same.
> That doesn't explain it. If the only options on accessing one of the "big sites" were to see ads and be tracked, or to pay €200 / year and not be, it is pretty obvious that fewer users would opt out of the tracking than now (when it is free).
It's too soon to say as the option only appeared recently, but taken to the extreme, if every single user of Google services opted out of tracking, Google would probably end up with a revenue problem and re-assess the situation.
The amount of clicks is definitely not the same; choosing to subscribe will certainly require filling in a dozen fields of personal information, provide credit card details, etc. The friction difference between 1 vs. 2 clicks is trivial compared to the friction added by a full subscription flow.
Of course entering a contract, requiring some form of online payment, will take more steps than not entering one.
The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions):
> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
Interestingly, the decision that you linked prefers to rely on the case law of the data protection authority when interpreting the question of consent, in particular referring to rulings that predate the GDPR, despite its refinement of the concept of consent. It also focuses upon 'wesentlicher Nachteil' (significant detriment) where the original text of the GDPR prohibits just 'Nachteil' detriment. I find these choices rather suspicious, and wouldn't be comfortable with relying on them holding if challenged in other EU states.
[0]: https://www.theregister.com/2018/11/19/ico_washington_post/
> The decision that you link also seems very much at-odds with the text of the GDPR (in both the German and English versions):
>> (42) Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.*
I don't see why they should be at odds with the decision? Quoting:
"Gibt eine betroffene Person keine Einwilligung ab, so besteht die erste Konsequenz darin, dass diese ein O*-Abo abschließen kann. Dieses O*-Abo ist – wie festgestellt – frei von Werbung, frei von Daten-Tracking und frei von der Setzung von Fremdcookies. Das O*-Abo ist mit einem Preis von 6 Euro monatlich ab dem zweiten Monat auch keine unverhältnismäßig teure Alternative."
It's obviously without question that one can charge something for a service rendered -- the newspaper does not have to offer this for free.
And in the above text, the authority then opined that charging 6 Euro for a monthly subscription to read a newspaper is not unreasonable, hence the decision to opt into tracking is a free one, because the alternative is simply to pay 6 Euro for a month's access.
The GDPR reads as if its authors had a different understanding. For example, the 'data minimisation' principle indicates that you should not be collecting personal data unless doing so would prevent the desired activity; serving an article, or even serving an article with adverts, can both be achieved without this data. There's also a question over whether the services are the same: a subscription appears to be materially different to one-shot access to an article, a question which is entirely overlooked in their analysis.
Beyond the weakening of 'detriment' to 'significant detriment' by reference to their pre-GDPR decisions, I also find the result unusual. The practical interpretation is that, if a user wishes to read 100 articles from 100 service providers all using this scheme, the cost of privacy is a significant detriment at €600. I am not confident that other data protection authorities will be as eager to jump to this same weakened interpretation.
There is probably a safer middle ground: giving the user the option to pay for either the article or the subscription, and allowing for either direct payment or payment by proxy through an advertising broker. In the latter context, the user's relationship and data-flow is controlled by the advertising broker, and the service provider needs no data relationship with the user. Of course, this shifts the controller liability into the advertisers -- something that they would probably prefer to avoid -- and I'm not aware of any services offering this or concrete decision on it yet.
Indeed. It could reasonably be assumed that this is the main reason why the paid version does not use any tracking.
> There's also a question over whether the services are the same: a subscription appears to be materially different to one-shot access to an article, a question which is entirely overlooked in their analysis.
Well, the service is being offered on a monthly basis alone. The customer may only desire a one-shot access, but that offer is simply not on the table.
I may only be interested one-shot access to [some-Netflix-movie], but the smallest access unit Netflix is willing to sell me is a month. Same goes for certain gym memberships. etc.
> The practical interpretation is that, if a user wishes to read 100 articles from 100 service providers all using this scheme, the cost of privacy is a significant detriment at €600.
Accessing a 100 difference service providers is on the customer, though?
Same example as above. Say the customer wants to watch just one movie on Netflix, Disney+, and 98 other providers, all charging $10/month. $1000 per month sounds a lot but that's entirely on the customer; they could also just spend only $10 and watch 100 movies on Netflix.
This was communicated to me by a law firm specializing this area. This was with regards to the newspaper "derstandard.at".
Here's a source in German which includes the ruling as a PDF [1].
I see that in the meantime, this "pay or okay" model has been questioned again, but in any case, a ruling exists. And, as I was told, the national DPAs don't just rule as they see fit, but rather coordinate with other DPAs, in order to harmonize the enforcement across the EU.
[1] https://www.dataprotect.at/2018/12/07/payortrack-die-entsche...
> If it's really a legit option, it seems like a miracle that nobody else is using this.
None of the big sites are using it because it's frequently far more profitable to track people. Just look at various revenue-per-user stats.
And the users most willing to spend money for no-tracking tend to be the users who also spend money on other things, so their the users you'd want to advertise to the most.