Two years into Meta's experiment with offering EU users a choice between personalised advertising or a paid, ad-free subscription, the regulatory verdict is becoming unmistakable: Brussels does not like it. The European Data Protection Board's Opinion 08/2024 in April 2024 set the tone, ruling that binary 'consent or pay' choices generally cannot deliver freely given GDPR consent when offered by large online platforms. The European Commission followed in April 2025 with a non-compliance decision under the Digital Markets Act and a reported €200 million fine. Now, in 2026, NOYB and a coalition of European consumer groups continue to press complaints against Meta's revised 'less personalised ads' option across multiple national data protection authorities.
For an industry built on ad-supported access, this matters far beyond Meta. The implicit message from regulators is that neither extracting consent under threat of paywall, nor charging users to escape tracking, satisfies European law. What, then, is the lawful business model for free services that two billion Europeans rely on?
How we got here
Meta's 'pay or consent' offer launched in the EU in late 2023 as a direct response to the Court of Justice's Bundeskartellamt ruling (Case C-252/21, July 2023), which held that Meta could not lean on 'contractual necessity' or 'legitimate interests' to process personal data for behavioural advertising. Consent became the only viable legal basis. Meta's solution: ask users to either consent to personalised ads or pay a monthly subscription (initially around €9.99/month on web, more on mobile) for an ad-free experience.
The EDPB's Opinion 08/2024, requested by the Dutch, Norwegian and Hamburg authorities, concluded that in most cases large platforms offering only this binary choice will fail the GDPR's 'freely given' test. Regulators urged a 'genuine third option' — a free service with less invasive advertising, such as contextual ads not relying on extensive behavioural profiling.
Meta responded in late 2024 with a 'less personalised ads' alternative that uses contextual signals and a narrower data set. NOYB and BEUC-affiliated consumer groups argue the new option still relies on consent dynamics that are not truly free and that the underlying data flows remain too broad. Complaints filed across DPAs in Austria, France, the Netherlands and Spain through 2025 and into 2026 keep the legal pressure live, even as Meta insists its model is GDPR-compliant.
A regulatory pile-up, not a coherent rulebook
The deeper problem is that three regimes are now layered on the same conduct — GDPR, the DMA, and the Digital Services Act — without a clear hierarchy. The Commission's April 2025 DMA decision treated Meta's model as a failure to provide an 'equivalent' alternative under Article 5(2). The EDPB applies a different test under GDPR consent rules. National DPAs and courts apply yet others. Meta cannot redesign once and satisfy all of them simultaneously, because the standards do not align.
This is not a technicality. When the regulatory goalposts move with each new opinion, platforms either over-comply by stripping features Europeans value, or freeze investment in EU-specific products altogether. Mistral, Spotify and a coalition of European publishers have publicly warned that ambiguity in GDPR and DMA enforcement is degrading the bloc's digital competitiveness — a concern echoed in the Draghi report on European competitiveness (September 2024), which called out fragmented digital rules as a drag on scale.
What proportionate regulation would look like
None of this is to say users should have no choice. The principle that people should not be forced to surrender data as the price of access to essential services is sound. But Meta is not an essential service in the sense electricity or banking are, and the EU already has tools — the Unfair Commercial Practices Directive, the Consumer Rights Directive, the DSA's transparency obligations — to police manipulative design.
A more proportionate framework would:
- Codify the 'third option' through legislation rather than evolving opinion, so platforms know what 'less personalised' actually requires.
- Set objective price-reasonableness benchmarks for paid alternatives, instead of leaving the question to case-by-case enforcement.
- Coordinate GDPR and DMA enforcement via a single lead authority for cross-border consent design, ending the multi-front legal exposure that punishes good-faith iteration.
The risk of the current trajectory is real. If neither free-with-ads nor pay-for-privacy can be made to work in Europe, platforms will quietly degrade the European product, smaller publishers reliant on programmatic advertising will lose revenue, and the open internet's most successful funding model will erode — replaced not by privacy nirvana, but by walled gardens and weaker European challengers.
The bigger picture
Europe has been right to push back on dark patterns and forced consent. It is now in danger of being wrong about the alternatives. A regulatory environment in which every business model is presumptively illegal until an opinion clarifies otherwise is not pro-privacy — it is pro-incumbency, pro-litigation, and quietly anti-consumer. The way out is not more enforcement actions against Meta. It is a legislative settlement that tells every platform, large and small, exactly what a lawful ad-funded service in Europe looks like.
Until then, the pay-or-consent saga will keep generating fines, complaints and uncertainty — and Europe's users will keep getting the worst of both worlds.