European Regulators and Courts Challenge Publishers’ “Pay or Okay” Tracking Models

German and Austrian enforcement actions have found specific news-site “Pay or Okay” implementations unlawful, intensifying scrutiny of models that require readers to accept tracking or pay for access without it. Lower Saxony’s data protection authority reprimanded heise.de over its 2021 implementation, finding tracking before consent, insufficient purpose-specific choices, inadequate information and consent that was neither freely given nor easily withdrawn. Austria’s Federal Administrative Court upheld a finding against DerStandard.at because its consent lacked granularity for specific processing purposes. Neither decision establishes a blanket prohibition on these models. DerStandard was permitted a further appeal; any referral to the EU’s highest court remains uncertain. Privacy group noyb criticized Heise’s reprimand as insufficient and said its revised banner still obscured privacy choices.

Noyb’s broader campaign targets SPIEGEL.de, Zeit.de, heise.de, FAZ.net, derStandard.at, krone.at and t-online.de, arguing that subscription prices disproportionate to tracking revenue undermine freely given GDPR consent. Related litigation challenges Hamburg’s approval of SPIEGEL’s model and prolonged regulatory inaction on complaints concerning FAZ and t-online. Separately, the European Commission fined Meta €200 million under the Digital Markets Act for its March–November 2024 Facebook and Instagram “consent or pay” model, which lacked an equivalent, less-personalized option; its revised model remained under assessment in the cited decision. The cases highlight distinct GDPR and DMA obligations: organizations using tracking-linked subscriptions should review consent granularity, pre-consent tracking, withdrawal mechanisms and the alternatives offered, rather than assume that a paid option alone establishes compliance.