{"id":7076,"date":"2023-11-02T12:44:48","date_gmt":"2023-11-02T11:44:48","guid":{"rendered":"https:\/\/s8.tgin.eu\/?p=7076"},"modified":"2025-10-31T18:11:31","modified_gmt":"2025-10-31T17:11:31","slug":"data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test","status":"publish","type":"post","link":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/","title":{"rendered":"Data protection digest 18 – 31 Oct 2023: \u201cPay or Okay\u201d – Will Meta new subscription model survive the GDPR test?"},"content":{"rendered":"\n

In this issue, we look at Meta\u2019s new ads-free subscription model as the corporation runs out of available legal grounds for tracking and profiling people in the EU for targeted advertising, while being banned from using contract law and legitimate interest as justification.<\/em><\/p>\n\n\n\n

Meta subscription model vs GDPR<\/h4>\n\n\n\n

Meta platform’s latest announcement of ads-free paid services in Europe is now challenged by the EDPB\u2019s urgent binding decision<\/a>. At the request of the Norwegian privacy regulator, Meta will soon be banned from using the legal basis of the contract and legitimate interest for tracking and profiling users<\/a> for ad targeting across the entire EEA. The EDPB takes note of Meta’s new proposal to rely on a consent-based subscription model as a legal basis instead. The lead Irish Data Protection Commission is currently evaluating this together with the concerned supervisory authorities, (who have already expresses serious doubts<\/a>).<\/p>\n\n\n\n

Meta has just announced that it will offer people in the EU, EEA and Switzerland the choice to pay a monthly subscription to use Facebook and Instagram without any ads<\/a>. Meanwhile, advertisers will be able to continue running personalised advertising campaigns in Europe to reach those who choose to continue to receive a free, ad-supported online service. Meta believes the above subscription model – \u201cpay or agree\u201d<\/a> is a valid form of consent for an ads-funded service, anticipating the requirements of the European privacy regulators and the recent CJEU ruling<\/a>. <\/p>\n\n\n\n

Legal processes<\/h4>\n\n\n\n

America\u2019s AI Action:<\/strong> President Biden issued a comprehensive Executive Order on Safe, Secure, and Trustworthy Artificial Intelligence. The most sweeping actions compel the most powerful AI system developers to disclose their safety test findings and other key information to the US government. It promotes advancing the responsible use of AI in education as well as healthcare and the development of affordable and life-saving drugs. The document also promotes best practices to mitigate harms and maximize benefits of AI for workers and customers. Finally, it emphasizes the responsible government deployment of AI and modernization of the federal AI infrastructure. <\/p>\n\n\n\n

Biden\u2019s Administration will continue to collaborate with Congress to pursue bipartisan legislation for responsible innovation. The US Department of Commerce, along with the National Institute of Standards and Technology<\/a> and other federal players will be responsible for carrying out the EO\u2019s objectives. <\/p>\n\n\n\n

Draft EU AI Act: <\/strong>Meanwhile, the EDPS issued its opinion on the Artificial Intelligence Act<\/a>, as discussions between the EU’s co-legislators reach the final stages. It includes the banning of high-risk AI systems with decision-making patterns<\/a>, such as for automatic recognition of human characteristics and other behavioural signals in public spaces, as well as profiling based on biometric traits. The EDPS is prepared to serve as the EU’s AI Supervisor and welcomes the formation of the European Artificial Intelligence Office. It believes that persons harmed by the usage of AI systems should have the right to file a complaint with competent national data protection authorities. <\/p>\n\n\n\n

Legal redress<\/h4>\n\n\n\n

Clearview AI escapes punishment:<\/strong> Last year the UK Information Commissioner fined Clearview more than 7.5 million pounds for illegally keeping millions of face pictures. Now the First-tier Tribunal has quashed the enforcement as the company services were only utilised by law enforcement agencies outside the UK<\/a>. Although Clearview did engage in data processing connected to monitoring people’s behaviour in the UK, the ICO “did not have jurisdiction” to initiate enforcement action or levy a fine. France, Italy and Australia had taken similar action against the firm. Clearview previously had commercial customers, but following a 2020 settlement with the US, the company now only takes clients that carry out criminal law enforcement or national security duties. <\/p>\n\n\n\n

Official guidance<\/h4>\n\n\n\n

Shoplifting: <\/strong>According to the UK Information Commissioner, more retailers are turning to technology to protect their businesses<\/a>. Data protection law enables retailers to share criminal offence data as long as it’s necessary and proportionate. Sharing information with a manager of another store in your shopping centre is likely to be appropriate, while wider public disclosures, such as posting it on an online retail-related social media platform, are less likely to be justifiable. <\/p>\n\n\n\n

Consent criteria: <\/strong>Quebec has published guidelines on valid consent criteria, (in French). Consent must be obtained before carrying out any processing activity. It is also essential that the organisation document. Consent must be: evident, free, informed, specific, granular, understandable, temporary, and presented separately from any other information. Subject to exceptions, organisations must obtain consent to reuse data or to disclose it to a third party. Equally, consent can be withdrawn at any time by the data subject. If any above are not respected, the validity of such consent is to be null.<\/p>\n\n\n\n

DP Toolkit:<\/strong> Jersey\u2019s data protection authority created a dedicated resource zone<\/a>. It features a variety of toolkits for small, medium and large organisations as well as financial services, non-executive directors, and non-profit organisations: a blend of infographics, step-by-step guidance, how-to-guides, templates, checklists and videos. <\/p>\n\n\n\n

AI Q&A:<\/strong> The French privacy regulator published the first set of guidelines for the use of AI that respects the GDPR. The CNIL confirms the compatibility of AI research and development with the data protection principles. The principle of data minimisation does not prevent the training of algorithms on very large datasets. On the other hand, the data used must, in principle, have been selected to optimise the training while avoiding the use of unnecessary information. In any case, certain precautions to ensure data security are essential. <\/p>\n\n\n\n

Enforcement decisions<\/h4>\n\n\n\n

BBVA: <\/strong>Following a complaint by an individual, the Spanish data protection regulator issued a fine of one million euros on Banco Bilbao Vizcaya Argentaria, (BBVA).The complainant, a BBVA client, had lost their purse containing their bank card. Following that, they claimed to have demanded that BBVA block all of their banking products. Third parties reportedly used identity theft to access the complainant’s financial products, take out loans, and transfer money<\/a> from the complainant’s bank accounts after BBVA allegedly refused to act on the complainant’s request.<\/p>\n\n\n\n

Canal+:<\/strong> The French data protection authority CNIL fined CANAL+ group 600,000 euros for poor data practices<\/a>. In particular its standard forms for the collection of prospect data did not contain any information on the identity of the recipients to whom the data was transmitted. It also failed to inform individuals<\/a> when creating a MyCanal account and during cold calling calls. The company also did not respond to some access requests. Apart from that, the CNIL found that a subcontracting contract did not include all the information required, and the storage of the company’s employees’ passwords was not sufficiently secure.<\/p>\n\n\n\n

Data breaches<\/h4>\n\n\n\n

Gap Personnel:<\/strong> A UK recruitment company did not have appropriate security measures in place, which resulted in an unauthorised threat actor<\/a> accessing and exfiltrating individuals’ data, (13,720 UK data subjects), twice within 12 months. Gap was unable to determine the specific cause of the incident but believes it is likely that the threat actor leveraged an insecure script, (PHP file), and performed an SQL injection attack. At the time of the incident, there were four specific vulnerabilities: a) an unsupported version of MySQL, b) an unsupported PHP version, c) poorly written PHP code and d) insufficient logging. <\/p>\n\n\n\n

Optionis:<\/strong> In another similar reprimand, a data controller, (Optionis Group), suffered a ransomware attack, which resulted in the exfiltration of personal data. A reprimand was issued in respect of specific infringements of the UK GDPR, which include lack of multi-factor authentication, an inadequate account lockout policy, and no clear Bring Your Own Device policy.  Aggravating factors were that Optionis took 11 months to notify all individuals of the breach. The company explained that the analysis of the impacted personal data took a considerable amount of time to complete, in particular, due to the size of the dataset. You can read the full decision here. <\/p>\n\n\n\n

Data security<\/h4>\n\n\n\n

Telehealth:<\/strong> The US Office for Civil Rights released a HIPAA dedicated resource <\/a>to help health care providers explain to patients, in plain language, the health information privacy and security risks that are present when using remote communication technologies such as video conferencing websites and applications. The HIPAA Rules do not require covered health care providers to educate patients about these risks; however, OCR is sharing this resource to assist providers who would like to explain to patients the privacy and security risks to their protected health information. Some examples of risks include viruses and other malware, unauthorized access, and accidental disclosures. <\/p>\n\n\n\n

Code of Practice for app developers: <\/strong>The UK government published the latest version<\/a> of its code, which should be used from now on by app store operators and app developers. The UK government has investigated the app ecosystem and found a range of threats relating to malicious and poorly developed apps. In particular, app store operators and developers shall comply with the broader requirements of data protection law, therefore new sections have been added to highlight requirements of particular relevance to the Code of Practice. <\/p>\n\n\n\n

Non-banking financial services: <\/strong>The US Federal Trade Commission has approved an amendment that would require non-banking financial institutions, such as mortgage brokers, motor vehicle dealers, and payday lending institutions, to report data security breaches<\/a>. The amendment will require the FTC to be notified as soon as possible, and no later than 30 days after discovery, of a security breach involving the information of at least 500 consumers. Such an event requires notification if unencrypted customer information has been acquired without authorization. The notice to the FTC must also include the number of consumers affected or potentially affected.<\/p>\n\n\n\n

Big Tech<\/h4>\n\n\n\n

SolarWinds breach aftershock: <\/strong>The US Securities and Exchange Commission charges SolarWinds and its Chief Information Security Officer with fraud and internal control failures<\/a>. In 2020, hackers targeted SolarWinds by deploying malicious code into its Orion IT monitoring and management software<\/a> used by thousands of enterprises and government agencies worldwide. The complaint alleges the software company misled investors about its cybersecurity practices and known risks, in particular, that SolarWinds\u2019 remote access set-up was not very secure and that someone exploiting the vulnerability \u201ccould basically do whatever without detecting it\u201d.<\/p>\n\n\n\n

In-vehicle monitoring: <\/strong>California enacted legislation that requires vehicle manufacturers to disclose the presence of in-vehicle cameras<\/a> and prohibits any images or video recordings collected from being used for any advertising purpose, sold, or shared with any third party. The act requires consent to retain at any location other than the vehicle itself or download, retrieve a recording from the operation of an in-vehicle camera by a person or entity other than the user unless for diagnostics, service, repair, or improvement of equipment and systems. The act also provides consumers the right to revoke consent.<\/p>\n\n\n\n

London Ulez fines:<\/strong> The Guardian reports that thousands of fines for breaches of London\u2019s ultra-low emissions zone, (Ulez), rules may have been sent unlawfully to EU drivers, according to the Belgian authorities. Since Brexit, UK authorities do not have access to personal data of EU citizens for non-criminal enforcement. However, drivers in several EU countries have received fines, many totalling thousands of pounds, for failing to pay their Ulez charge before driving into London. Some have been penalised mistakenly, and one driver was fined nearly 11,000 pounds after a three-day visit in a hire car. Read the full story here<\/a>. <\/p>\n","protected":false},"excerpt":{"rendered":"

In this issue, we look at Meta\u2019s new ads-free subscription model as the corporation runs out of available legal grounds for tracking and profiling people in the EU for targeted advertising, while being banned from using contract law and legitimate interest as justification. Meta subscription model vs GDPR Meta platform’s latest announcement of ads-free paid […]<\/p>\n","protected":false},"author":21,"featured_media":7077,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[94],"tags":[51,109,98,97,58,72,262],"class_list":["post-7076","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-data-protection-digest","tag-artificial-intelligence","tag-automotive","tag-direct-marketing","tag-dsr","tag-gdpr-compliance","tag-hipaa","tag-personalised-ads"],"acf":[],"featured_image_urls":{"full":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg",1280,939,false],"thumbnail":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-150x150.jpg",150,150,true],"medium":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-300x220.jpg",300,220,true],"medium_large":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-768x563.jpg",640,469,true],"large":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-1024x751.jpg",640,469,true],"1536x1536":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg",1280,939,false],"2048x2048":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg",1280,939,false],"image-200-200":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-200x200.jpg",200,200,true]},"post_excerpt_stackable":"

In this issue, we look at Meta\u2019s new ads-free subscription model as the corporation runs out of available legal grounds for tracking and profiling people in the EU for targeted advertising, while being banned from using contract law and legitimate interest as justification. Meta subscription model vs GDPR Meta platform’s latest announcement of ads-free paid services in Europe is now challenged by the EDPB\u2019s urgent binding decision. At the request of the Norwegian privacy regulator, Meta will soon be banned from using the legal basis of the contract and legitimate interest for tracking and profiling users for ad targeting across…<\/p>\n","category_list":"Data Protection Digest<\/a>","author_info":{"name":"Olya Vasylyk","url":"https:\/\/techgdpr.com\/blog\/author\/olyav\/"},"comments_num":"0 comments","featured_image_urls_v2":{"full":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg",1280,939,false],"thumbnail":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-150x150.jpg",150,150,true],"medium":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-300x220.jpg",300,220,true],"medium_large":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-768x563.jpg",640,469,true],"large":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-1024x751.jpg",640,469,true],"1536x1536":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg",1280,939,false],"2048x2048":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg",1280,939,false],"image-200-200":["https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280-200x200.jpg",200,200,true]},"post_excerpt_stackable_v2":"

In this issue, we look at Meta\u2019s new ads-free subscription model as the corporation runs out of available legal grounds for tracking and profiling people in the EU for targeted advertising, while being banned from using contract law and legitimate interest as justification. Meta subscription model vs GDPR Meta platform’s latest announcement of ads-free paid services in Europe is now challenged by the EDPB\u2019s urgent binding decision. At the request of the Norwegian privacy regulator, Meta will soon be banned from using the legal basis of the contract and legitimate interest for tracking and profiling users for ad targeting across…<\/p>\n","category_list_v2":"Data Protection Digest<\/a>","author_info_v2":{"name":"Olya Vasylyk","url":"https:\/\/techgdpr.com\/blog\/author\/olyav\/"},"comments_num_v2":"0 comments","yoast_head":"\nData protection digest 18 - 31 Oct 2023: \u201cPay or Okay\u201d - Will Meta new subscription model survive the GDPR test? - TechGDPR<\/title>\n<meta name=\"description\" content=\"TechGDPR\u2019s review of the most important data-related stories: \u201cPay or Okay\u201d- Will Meta\u2019s new subscription model survive the GDPR test?\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Data protection digest 18 - 31 Oct 2023: \u201cPay or Okay\u201d - Will Meta new subscription model survive the GDPR test? - TechGDPR\" \/>\n<meta property=\"og:description\" content=\"TechGDPR\u2019s review of the most important data-related stories: \u201cPay or Okay\u201d- Will Meta\u2019s new subscription model survive the GDPR test?\" \/>\n<meta property=\"og:url\" content=\"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/\" \/>\n<meta property=\"og:site_name\" content=\"TechGDPR\" \/>\n<meta property=\"article:published_time\" content=\"2023-11-02T11:44:48+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-31T17:11:31+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1280\" \/>\n\t<meta property=\"og:image:height\" content=\"939\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Olya Vasylyk\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@techgdpr\" \/>\n<meta name=\"twitter:site\" content=\"@techgdpr\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Olya Vasylyk\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"9 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/\"},\"author\":{\"name\":\"Olya Vasylyk\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#\\\/schema\\\/person\\\/07e9c14fd01b25bd2c1907537e8547e8\"},\"headline\":\"Data protection digest 18 – 31 Oct 2023: \u201cPay or Okay\u201d – Will Meta new subscription model survive the GDPR test?\",\"datePublished\":\"2023-11-02T11:44:48+00:00\",\"dateModified\":\"2025-10-31T17:11:31+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/\"},\"wordCount\":1895,\"publisher\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2023\\\/11\\\/laptop-7833608_1280.jpg\",\"keywords\":[\"Artificial Intelligence\",\"automotive\",\"direct marketing\",\"DSR\",\"GDPR Compliance\",\"HIPAA\",\"personalised ads\"],\"articleSection\":[\"Data Protection Digest\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/\",\"url\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/\",\"name\":\"Data protection digest 18 - 31 Oct 2023: \u201cPay or Okay\u201d - Will Meta new subscription model survive the GDPR test? - TechGDPR\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2023\\\/11\\\/laptop-7833608_1280.jpg\",\"datePublished\":\"2023-11-02T11:44:48+00:00\",\"dateModified\":\"2025-10-31T17:11:31+00:00\",\"description\":\"TechGDPR\u2019s review of the most important data-related stories: \u201cPay or Okay\u201d- Will Meta\u2019s new subscription model survive the GDPR test?\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#primaryimage\",\"url\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2023\\\/11\\\/laptop-7833608_1280.jpg\",\"contentUrl\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2023\\\/11\\\/laptop-7833608_1280.jpg\",\"width\":1280,\"height\":939,\"caption\":\"subscription model\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/techgdpr.com\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Data protection digest 18 – 31 Oct 2023: \u201cPay or Okay\u201d – Will Meta new subscription model survive the GDPR test?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#website\",\"url\":\"https:\\\/\\\/techgdpr.com\\\/\",\"name\":\"TechGDPR\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/techgdpr.com\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#organization\",\"name\":\"TechGDPR\",\"url\":\"https:\\\/\\\/techgdpr.com\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/staging.techgdpr.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/TGDPR_logo_500px.png\",\"contentUrl\":\"https:\\\/\\\/staging.techgdpr.com\\\/wp-content\\\/uploads\\\/2018\\\/04\\\/TGDPR_logo_500px.png\",\"width\":501,\"height\":334,\"caption\":\"TechGDPR\"},\"image\":{\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/techgdpr\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/techgdpr\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/#\\\/schema\\\/person\\\/07e9c14fd01b25bd2c1907537e8547e8\",\"name\":\"Olya Vasylyk\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/readyIMG_3694-1-2-150x150.jpg\",\"url\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/readyIMG_3694-1-2-150x150.jpg\",\"contentUrl\":\"https:\\\/\\\/techgdpr.com\\\/wp-content\\\/uploads\\\/2021\\\/10\\\/readyIMG_3694-1-2-150x150.jpg\",\"caption\":\"Olya Vasylyk\"},\"description\":\"Creator and editor of TechGDPR\u2019s weekly Digest. Postgraduate masters Diploma in Data Protection, Digital law and Management. Over a decade Olga previously was a broadcast journalist in Ukraine and France specializing in international affairs.\",\"url\":\"https:\\\/\\\/techgdpr.com\\\/blog\\\/author\\\/olyav\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Data protection digest 18 - 31 Oct 2023: \u201cPay or Okay\u201d - Will Meta new subscription model survive the GDPR test? - TechGDPR","description":"TechGDPR\u2019s review of the most important data-related stories: \u201cPay or Okay\u201d- Will Meta\u2019s new subscription model survive the GDPR test?","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/","og_locale":"en_US","og_type":"article","og_title":"Data protection digest 18 - 31 Oct 2023: \u201cPay or Okay\u201d - Will Meta new subscription model survive the GDPR test? - TechGDPR","og_description":"TechGDPR\u2019s review of the most important data-related stories: \u201cPay or Okay\u201d- Will Meta\u2019s new subscription model survive the GDPR test?","og_url":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/","og_site_name":"TechGDPR","article_published_time":"2023-11-02T11:44:48+00:00","article_modified_time":"2025-10-31T17:11:31+00:00","og_image":[{"width":1280,"height":939,"url":"https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg","type":"image\/jpeg"}],"author":"Olya Vasylyk","twitter_card":"summary_large_image","twitter_creator":"@techgdpr","twitter_site":"@techgdpr","twitter_misc":{"Written by":"Olya Vasylyk","Est. reading time":"9 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#article","isPartOf":{"@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/"},"author":{"name":"Olya Vasylyk","@id":"https:\/\/techgdpr.com\/#\/schema\/person\/07e9c14fd01b25bd2c1907537e8547e8"},"headline":"Data protection digest 18 – 31 Oct 2023: \u201cPay or Okay\u201d – Will Meta new subscription model survive the GDPR test?","datePublished":"2023-11-02T11:44:48+00:00","dateModified":"2025-10-31T17:11:31+00:00","mainEntityOfPage":{"@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/"},"wordCount":1895,"publisher":{"@id":"https:\/\/techgdpr.com\/#organization"},"image":{"@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#primaryimage"},"thumbnailUrl":"https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg","keywords":["Artificial Intelligence","automotive","direct marketing","DSR","GDPR Compliance","HIPAA","personalised ads"],"articleSection":["Data Protection Digest"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/","url":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/","name":"Data protection digest 18 - 31 Oct 2023: \u201cPay or Okay\u201d - Will Meta new subscription model survive the GDPR test? - TechGDPR","isPartOf":{"@id":"https:\/\/techgdpr.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#primaryimage"},"image":{"@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#primaryimage"},"thumbnailUrl":"https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg","datePublished":"2023-11-02T11:44:48+00:00","dateModified":"2025-10-31T17:11:31+00:00","description":"TechGDPR\u2019s review of the most important data-related stories: \u201cPay or Okay\u201d- Will Meta\u2019s new subscription model survive the GDPR test?","breadcrumb":{"@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#primaryimage","url":"https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg","contentUrl":"https:\/\/techgdpr.com\/wp-content\/uploads\/2023\/11\/laptop-7833608_1280.jpg","width":1280,"height":939,"caption":"subscription model"},{"@type":"BreadcrumbList","@id":"https:\/\/techgdpr.com\/blog\/data-protection-digest-02112023-will-new-subscription-model-of-meta-survive-the-gdpr-test\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/techgdpr.com\/"},{"@type":"ListItem","position":2,"name":"Data protection digest 18 – 31 Oct 2023: \u201cPay or Okay\u201d – Will Meta new subscription model survive the GDPR test?"}]},{"@type":"WebSite","@id":"https:\/\/techgdpr.com\/#website","url":"https:\/\/techgdpr.com\/","name":"TechGDPR","description":"","publisher":{"@id":"https:\/\/techgdpr.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/techgdpr.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/techgdpr.com\/#organization","name":"TechGDPR","url":"https:\/\/techgdpr.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/techgdpr.com\/#\/schema\/logo\/image\/","url":"https:\/\/staging.techgdpr.com\/wp-content\/uploads\/2018\/04\/TGDPR_logo_500px.png","contentUrl":"https:\/\/staging.techgdpr.com\/wp-content\/uploads\/2018\/04\/TGDPR_logo_500px.png","width":501,"height":334,"caption":"TechGDPR"},"image":{"@id":"https:\/\/techgdpr.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/techgdpr","https:\/\/www.linkedin.com\/company\/techgdpr"]},{"@type":"Person","@id":"https:\/\/techgdpr.com\/#\/schema\/person\/07e9c14fd01b25bd2c1907537e8547e8","name":"Olya Vasylyk","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/techgdpr.com\/wp-content\/uploads\/2021\/10\/readyIMG_3694-1-2-150x150.jpg","url":"https:\/\/techgdpr.com\/wp-content\/uploads\/2021\/10\/readyIMG_3694-1-2-150x150.jpg","contentUrl":"https:\/\/techgdpr.com\/wp-content\/uploads\/2021\/10\/readyIMG_3694-1-2-150x150.jpg","caption":"Olya Vasylyk"},"description":"Creator and editor of TechGDPR\u2019s weekly Digest. Postgraduate masters Diploma in Data Protection, Digital law and Management. Over a decade Olga previously was a broadcast journalist in Ukraine and France specializing in international affairs.","url":"https:\/\/techgdpr.com\/blog\/author\/olyav\/"}]}},"_links":{"self":[{"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/posts\/7076","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/users\/21"}],"replies":[{"embeddable":true,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/comments?post=7076"}],"version-history":[{"count":22,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/posts\/7076\/revisions"}],"predecessor-version":[{"id":11280,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/posts\/7076\/revisions\/11280"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/media\/7077"}],"wp:attachment":[{"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/media?parent=7076"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/categories?post=7076"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techgdpr.com\/wp-json\/wp\/v2\/tags?post=7076"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}