Consent or pay
-
Due to the Data (Use and Access) Act coming into law on 19 June 2025, this guidance is under review and may be subject to change. The Plans for new and updated guidance page will tell you about which guidance will be updated and when this will happen.
Latest updates - 20 October 2025
20 October 2025 - this guidance was published
What is consent or pay?
“Consent or pay” refers to an advertising business model for funding online products and services. This model gives you a choice to:
- consent to an organisation using your personal information for personalised advertising to access a product or service;
- pay a fee to access the product or service and avoid the organisation using your personal information for personalised advertising; or
- leave or decide not to use the product or service.
How does it work?
When an organisation adopts a consent or pay model, you'll typically be prompted to make a decision as soon as you visit a website or app - often resembling the cookie banners you see when you first visit a service online. A consent or pay model presents a choice between either consenting to personalised advertising or rejecting personalised ads and instead paying a fee to access the service.
Some consent or pay models may also offer you additional options for accessing the service, such as a "free" option that serves non-personalised ads to the user. While other organisations may offer the choice not to receive advertising at all.
If you choose to accept personalised advertising, the website will deliver targeted advertising based on a profile of you created by the service.
They will usually base the profile on the following information:
- Provided data: information you intentionally provide to the product or service. This includes your age, gender or interests you have provided when signing up or creating a profile.
- Observed data: information the service has gathered through observing or tracking your activity, such as the types of content you engage with. This could also include your activity on other online products or services that you use.
- Inferred data: additional information that the service assumes about you, based on the provided or observed information. For example, inferring that your interest in a particular band means you are likely to be interested in concert tickets for a similar band when they play a concert near you.
Choosing to pay a fee to access the product or service means the organisation must not use your personal information to target you with advertising.
Depending on the service you’re using, you may still see adverts which are selected for relevance to you based on the content of the page you are viewing. This is known as contextual advertising. For example, you might see an advert for running shoes if you are reading an article or blog about keeping fit.
Is consent or pay legal?
Yes, consent or pay models can be compliant with data protection law. The organisation adopting the consent or pay model must demonstrate that people can freely give their consent to use their information for personalised advertising. We have guidance for organisations considering adopting consent or pay models, which includes details about what they need to think about when assessing if their model is compliant.
If I choose not to pay and give them permission to use my personal information, what does that actually mean? How will they use my information?
If you accept personalised advertising, the organisation needs to explain to you how they will use your personal information. You must receive clear and comprehensive explanations about what each option means.
If the organisation offers you the choice to “consent or pay”, they can’t then use your consent to cover other uses of your personal information not linked to personalised advertising. Each choice must stand alone. The organisation must offer you separate consent requests for other uses of your personal information.
Example
A consent or pay banner appears offering you the choice to accept personalised advertising or pay to remove personalised advertising. You accept personalised advertising. When you check your privacy settings, you notice that the website has also enabled content personalisation, video embeds, and re-targeting for ads on other sites. These other uses are not linked to the personalised advertising use under the “consent or pay” model. They should not enable these without you giving separate consent to these uses.
What if I change my mind and want to withdraw consent?
Organisations must give you the option to withdraw consent to personalised advertising at any time. They must give clear information about how to do that and make sure it is easy to do. While you have a right to withdraw consent to personalised advertising, this does not mean you can access a site or use a service for free. Many organisations use the revenue they generate from personalised advertising to fund the product or service they provide. Our guidance is clear that if you withdraw consent, the organisation can take you back to the original consent or pay choice. You can then choose to pay or to leave the service.
You also have the right to object to direct marketing. In consent or pay models, organisations can fulfil a user’s objection to direct marketing using the same mechanism as they offer for users to withdraw consent from the model.
What can I do if I think the options I’m given are unfair and the model is not compliant?
If you’re unhappy with the way an organisation has handled your information, you should complain to them first. Most organisations will want to put things right, so giving them the opportunity to look into your complaint may help to address your concerns. You can find more information on how to do this, including a template letter that can help you, in the Raising a complaint with an organisation section of our website.
If you can’t resolve your complaint with the organisation directly, you can make a complaint to the ICO. We also have a service for people to report concerns about the use of cookies by organisations.
Further reading