Short answer
Yes, provided the app monetises your data rather than merely using it to run.
The Digital Content Directive extends to contracts with no price:
"This Directive shall also apply where the trader supplies or undertakes to supply digital content or a digital service to the consumer, and the consumer provides or undertakes to provide personal data to the trader, except where the personal data provided by the consumer are exclusively processed by the trader for the purpose of supplying the digital content or digital service in accordance with this Directive or for allowing the trader to comply with legal requirements to which the trader is subject, and the trader does not process those data for any other purpose." —
The Consumer Rights Directive was extended in parallel by Directive (EU) 2019/2161, which inserted Article 3(1a) in almost identical terms.
So the dividing line is not "free versus paid". It is what the data is used for:
- Data used for advertising, profiling, analytics beyond the service, or sale to third parties → the Directives apply.
- Data used only to deliver the service or to meet a legal obligation → they do not.
An email address used solely to run your account is outside. The same address fed into an advertising profile is inside.
Why the exception is narrower than it looks
The carve-out has three cumulative limbs, and traders regularly fail one.
The data must be processed exclusively for supplying the service or for legal compliance; and the trader must not process those data for any other purpose. The repetition is deliberate.
Common uses that take a trader outside the exception:
- Behavioural advertising or ad targeting.
- Analytics used for product development or commercial insight rather than delivery.
- Sharing or selling data to third parties.
- Building cross-service profiles.
- Data used for a group company's separate purposes.
A trader claiming to be outside the Directives needs a genuinely minimal processing posture, and its own privacy notice and records of processing will be the evidence used against it. In practice, most ad-funded consumer apps are covered.
Note the open-source carve-out in Article 3(5)(f): free and open-source software is excluded where the consumer pays no price and the personal data is processed exclusively to improve the security, compatibility or interoperability of that specific software.
What consumers actually get
The full conformity framework applies, with one notable asymmetry.
Objective conformity — Article 8. The service must be fit for the purposes for which services of that type are normally used, and possess the qualities and performance features — functionality, compatibility, accessibility, continuity and security — normal for services of that type which the consumer may reasonably expect, taking into account public statements including advertising.
"Free" does not lower the standard. A free app is measured against what free apps of that type normally deliver, not against nothing.
Updates — Article 8(2). The trader must inform the consumer of, and supply, updates including security updates necessary to keep the service in conformity, for the contractual supply period or for the period the consumer may reasonably expect.
Burden of proof — Article 12. On the trader for one year after supply for a single act of supply, and throughout the supply period for continuous supply.
Modifications — Article 19. The same conditions and the same 30-day termination right for modifications with more than minor negative impact.
The asymmetry: termination is easier
Two provisions are keyed to the payment of a price, and this works in the consumer's favour.
Article 14(4) offers a price reduction "where the digital content or digital service is supplied in exchange for a payment of a price". With no price, there is nothing to reduce — so price reduction is unavailable.
But Article 14(6) is the one that matters:
"Where the digital content or digital service is supplied in exchange for the payment of a price, the consumer shall be entitled to terminate the contract only if the lack of conformity is not minor. The burden of proof with regard to whether the lack of conformity is minor shall be on the trader." —
The "not minor" restriction is expressly confined to contracts supplied for a price. Where the consumer provides personal data instead, that limitation does not apply on the face of the provision — so the termination remedy is not subject to the same minor-defect filter.
The practical effect is that a data-funded service has fewer intermediate remedies but a more readily available exit.
What termination is worth without a price
Article 16(1) requires reimbursement of "all sums paid under the contract". For a data-funded service there are usually none. So the value of terminating lies elsewhere:
Your content comes back. Article 16(3) restricts the trader from using content other than personal data provided or created by the consumer, subject to four exceptions — no utility outside the service, relating only to the consumer's activity, aggregated and not reasonably separable, or generated jointly with others still using it.
Article 16(4) gives the consumer, on request, the right to retrieve that content free of charge, without hindrance, within a reasonable time and in a commonly used and machine-readable format.
Personal data follows the GDPR. Article 16(2) requires the trader to comply with Regulation (EU) 2016/679 in respect of personal data.
The trader may cut off access. Article 16(5) permits preventing further use, including disabling the account, without prejudice to the Article 16(4) retrieval right. The retrieval right survives account closure, which is why consumers should exercise it promptly.
GDPR and contract law run in parallel
Article 3(8) is explicit that Union data-protection law applies to any personal data processed in connection with these contracts, that the Directive is without prejudice to the GDPR and the ePrivacy Directive, and that in the event of conflict the data-protection rules prevail.
Two consequences that are easy to get wrong:
Consumer rights do not legitimise the processing. The fact that a contract is within the Digital Content Directive says nothing about whether the processing has a lawful basis under Article 6 GDPR. Those are separate questions, and the data-protection analysis governs.
Withdrawing consent and terminating the contract are different acts. Consent under the GDPR is withdrawable at any time under Article 7(3), and that is not the same as terminating the supply contract. A consumer may do one, the other, or both.
The Consumer Rights Directive addresses the interface too: Article 13(4) requires the trader to comply with GDPR obligations on withdrawal, and Articles 13(5) to (8) mirror the content-retrieval rules.
Consumer Rights Directive obligations also apply
Because CRD Article 3(1a) brings data-funded digital services into scope, the pre-contract information duties in Article 6 apply — including functionality and technical protection measures under point (r), and compatibility and interoperability under point (s).
The withdrawal right applies too, subject to the Article 16(m) exception. Note its wording: the exception operates "if the contract places the consumer under an obligation to pay" and the three consent, acknowledgement and confirmation conditions are met. For a contract with no payment obligation, the conditional structure of that exception does not engage in the same way — which is a further reason for traders not to assume that "free" means "no withdrawal right".
Practical guidance
For consumers:
- Free does not mean unprotected; check what the app does with your data.
- Measure the service against what comparable services normally deliver.
- The trader must prove conformity for the first year, and throughout a continuous supply.
- Retrieve your content under Article 16(4) before losing access.
- Treat GDPR rights and contract rights as separate and cumulative.
For traders:
- Do not assume a free tier is outside the Directives; almost any secondary data use brings it in.
- Check your privacy notice and processing records against the Article 3(1) exception before relying on it.
- Apply the same conformity, update and modification discipline to free tiers as to paid.
- Build content export to satisfy Article 16(4).
- Remember that the "not minor" filter on termination is tied to payment of a price.
- Apply CRD Article 6 information duties to data-funded services.
Conclusion
The Digital Content Directive and the Consumer Rights Directive both treat personal data as capable of being the consumer's side of the bargain. An ad-funded or profiling app is a contract with obligations, not a gift.
The exception for data used exclusively to deliver the service is real but narrow, and most consumer apps fall outside it. Where the Directives apply, consumers get conformity standards, update obligations, a favourable burden of proof, protection against unilateral modification, and a termination route that is not filtered by the "not minor" test applicable to priced contracts — together with a right to take their content with them when they leave.
Sources
This article provides general legal information, not advice for a specific matter. Laws, facts and procedural deadlines may change the result. Follow the linked primary sources and obtain local advice before acting.