Short answer
Consent is freely given under the General Data Protection Regulation (GDPR) only when the person has a real choice and control. A controller must be able to show that refusing or withdrawing consent does not cause a detriment, that the request is not distorted by a clear power imbalance, and that access to a service is not made conditional on processing unnecessary for the contract. Consent must also be specific, informed and unambiguous: separate purposes require sufficiently granular choices, and agreeing must involve a clear affirmative action.
A service does not automatically invalidate consent by offering a paid, non-personalised alternative. In Meta Platforms and Others (General terms of use of a social network), Case C-252/21, the Court of Justice said that dominance is important but not conclusive and contemplated an equivalent alternative, if necessary for an appropriate fee. The price, equivalence of the alternative, network effects, lock-in, interface design and practical consequences of refusal all remain relevant.
For large online platforms using behavioural advertising, the European Data Protection Board (EDPB) takes a stricter supervisory view: in most cases, a binary “consent or pay” choice will not satisfy valid-consent requirements. That 2024 opinion is influential but non-binding, is confined to large online platforms, and does not replace the GDPR or the Court's fact-specific test.
What does “freely given” require?
Regulation (EU) 2016/679 defines consent in Article 4(11) as a freely given, specific, informed and unambiguous indication of wishes, expressed by a statement or clear affirmative action. Those elements are cumulative. A click cannot repair an absence of freedom or information.
Article 7 adds proof, presentation and withdrawal rules. The controller must demonstrate consent. A request inside a wider declaration must be clearly distinguishable, intelligible and accessible, in clear and plain language. Withdrawal must be as easy as giving consent. Article 7(4) then addresses conditional access:
“When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.” —
This is not an automatic ban on every condition. It requires close scrutiny of whether the processing is genuinely necessary. Recital 42 adds that consent is not free where the person has no genuine choice or cannot refuse or withdraw without detriment. Recital 43 identifies clear imbalance and presumes against freedom where appropriate processing operations cannot be accepted separately, or service access depends on unnecessary processing.
The GDPR has applied since 25 May 2018. National contract, consumer and employment rules may add constraints, but they cannot lower the Regulation's consent standard.
Can a controller make personalisation part of the contract?
Describing processing in terms of service does not make it necessary under Article 6(1)(b). In Case C-252/21, the Court of Justice held that contractual necessity means objectively indispensable to a purpose integral to the contractual obligation. Merely useful processing is insufficient, and independently performable service elements must be assessed separately.
On the facts referred, personalised content did not appear necessary to provide the social-network service because an equivalent, non-personalised alternative could be offered. Processing data from other group services likewise did not appear necessary for the social network itself. The Court also held, in that setting, that users could not reasonably expect extensive off-service tracking for personalised advertising without consent; the operator's advertising interest therefore did not prevail under Article 6(1)(f).
The practical question is consequently not whether a contract mentions advertising or personalisation. It is whether the service's main subject matter cannot be achieved without the particular operation and whether a workable, less intrusive alternative exists.
Does “consent or pay” provide a genuine choice?
The Court's answer in Case C-252/21 is deliberately contextual. A dominant position does not itself make consent impossible, but it may create a clear imbalance and reduce the user's ability to refuse without detriment. The controller bears the burden of proof.
The Court also required individual choice over unnecessary processing:
“Thus, those users must be free to refuse individually, in the context of the contractual process, to give their consent to particular data processing operations not necessary for the performance of the contract, without being obliged to refrain entirely from using the service offered by the online social network operator, which means that those users are to be offered, if necessary for an appropriate fee, an equivalent alternative not accompanied by such data processing operations.” —
That passage does not declare every fee appropriate. Nor does it establish a general entitlement to monetise consent. Equivalence, necessity and the user's real freedom still need proof. A degraded substitute, prohibitive price or nominal option that ignores accumulated contacts and content may leave no realistic choice. Dominance is one factor; dependence, network effects, lock-in, vulnerability and the service's role in social or professional life can matter even without a competition-law finding of dominance.
In EDPB Opinion 08/2024, the Board assessed large online platforms asking users to accept behavioural advertising or pay. It concluded:
“It has to be concluded that, in most cases, it will not be possible for large online platforms to comply with the requirements for valid consent if they confront users only with a binary choice between consenting to processing of personal data for behavioural advertising purposes and paying a fee.” —
The EDPB recommends serious consideration of a further free alternative without behavioural advertising, such as contextual advertising. If a fee is charged, it should not inhibit refusal or nudge users towards consent. This is a non-binding Article 64(2) opinion, not a judgment or a universal rule for every publisher or service. Its defined scope is large online platforms, and each controller remains responsible for its own documented assessment.
The EDPB's broader Guidelines 05/2020 similarly frame freedom around real choice and control. Inappropriate pressure, refusal detriment, unnecessary conditionality and non-negotiable bundling point against free consent. The Guidelines are non-binding general guidance.
Consent also does not authorise unlimited profiling. In Schrems v Meta Platforms Ireland, Case C-446/21, the Court held that data minimisation bars a social-network operator from processing personal data for targeted advertising without time limits or distinction by data type. The judgment addresses processing scope, not whether a consent-or-pay offer is free.
Why bundled processing and interface design matter
Consent is specific only if the user can understand and choose the relevant purposes. A single switch for content personalisation, behavioural advertising, audience measurement, service improvement and cross-service combination may conceal distinct operations. Recital 43 and the EDPB's opinion require granularity where separate consent is appropriate. This does not mean a separate button for every technical step serving one purpose; it means that genuinely different purposes must not be fused to force an all-or-nothing answer.
The interface must also record the person's action, not the controller's default. In Orange România, Case C-61/19, a telecommunications contract included a consent clause and a box pre-ticked by the controller. Some customers who refused had to complete an additional form. The Court held that a signature did not by itself prove that the preselected clause had been read and accepted, and stated:
“In any event, as is apparent from the considerations set out in paragraphs 35, 36 and 42 above, it is for Orange România, as the data controller, to establish that its customers have, by active behaviour, given their consent to the processing of their personal data, with the result that that company cannot require them actively to express their refusal.” —
Pre-ticked boxes, misleading wording, unequal paths and extra friction for refusal therefore affect more than usability. They can defeat the affirmative, informed and free character of consent. The same symmetry should continue after collection: withdrawal cannot be hidden behind a harder process.
A practical consent assessment
- Map each purpose and operation. Separate behavioural advertising from service functionality, measurement and improvement where they are genuinely distinct.
- Test necessity, not drafting. Ask whether the contractual service can be performed without each operation and identify workable, less intrusive alternatives.
- Compare the choices. Check functionality, quality, price, availability and whether the alternative truly omits the unnecessary processing.
- Assess real consequences. Consider exclusion, financial pressure, dominance, network effects, lock-in, accumulated content, vulnerability and professional or social dependence.
- Make refusal neutral. Avoid preselection, deceptive presentation, repeated prompts or extra steps that push the user towards accepting.
- Explain the processing. State the controller, data, purposes, recipients and consequences clearly enough for an informed choice.
- Keep proof. Record the version shown, the affirmative action, purpose-level choices and the assessment supporting any fee or conditional access.
- Make withdrawal equally easy. Stop consent-based processing after withdrawal and apply the same detriment and conditionality assessment to the consequences of withdrawing.
Conclusion
GDPR consent is genuinely free when the person can say no, purpose by purpose, without coercion, misleading friction or an unacceptable penalty. Conditional access is a warning sign where processing is not objectively indispensable. A paid equivalent can be relevant under Case C-252/21, but does not automatically validate consent: price, equivalence, imbalance, lock-in and granularity still matter. Large platforms should also account for the EDPB's narrower consent-or-pay opinion. The controller must prove a real, informed and reversible choice.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.