Cybersecurity Policy Report, Court Finds ‘Pay-or-OK’ Model Violates EU Privacy Law, (Aug 19, 2025)
By Tony Foley
The European Center for Digital Rights (NOYB) has highlighted a ruling of the Austrian Federal Administrative Court upholding a decision by Austria’s data protection authority that a newspaper violated consent requirements under the European Union’s General Data Protection Regulation (GDPR) in using the “pay-or-OK” digital advertising model.
Der Standard, a leading newspaper in Austria, was the first website to introduce a pay-or-OK approach after the GDPR took effect, asking users either to consent to receiving ads to access the paper’s website or to pay for a monthly subscription, NOYB noted yesterday in a news release.
NOYB claimed that, while only 1% to 7% of users expressed interest in being tracked for online advertising purposes, the pay-or-OK model results in 99.9% of users agreeing to such tracking.
DSB decision. Datenschutzbehörde (DSB), the Austrian DPA, ruled in 2023 that while there was not an issue in general with the pay-or-OK model, Der Standard’s approach to the model was unlawful because it only allowed a global consent or rejection, while the GDPR requires the option to consent to specific types of processing. The paper appealed the ruling, arguing that the granular consent mandated by DSB was infeasible in a pay-or-OK system.
“The DSB decision from 2023 was purely political: they don't want to touch news media, when on other pages even just a gray button in a cookie banner was found to be illegal,” said NOYB founder Max Schrems. “Instead of criticizing the overall approach and saying that consent rates of 99.9% show that consent was not ‘freely given,’ they ended up touching upon [a] minor issue. What we have here is a pure ‘fake choice’ that basically no one wants or uses—just to pretend that users would have an option.”
Court ruling. The decision of the Federal Administrative Court, issued yesterday, upheld the DSB ruling, rejecting Der Standard’s appeal. However, the court’s ruling, which may be downloaded from the news release but is available only in German, also allowed an appeal to the Supreme Administrative Court of Austria, given the novelty of the issue and the lack of a decision on the issue by any other Supreme Court. NOYB said it was likely that the Supreme Administrative Court would refer the case to the Court of Justice of the EU (CJEU).
"The decision of the Data Protection Authority was simply confirmed, knowing it will most likely go to the Supreme Administrative Court,” Mr. Schrems said. “I guess everyone involved is aware that ‘Pay or Okay’ will have to go to the CJEU.”
News: InternationalLegislation LitigationEnforcement DataPrivacy GDPR