A First Take on the European Commission’s DMA Decision Against Meta

The European Commission issued a significant noncompliance decision earlier today, finding the “consent or pay” model that Meta implemented from March 2024 to November 2024 for its Facebook and Instagram services breached key obligations imposed on designated gatekeepers under the Digital Markets Act (DMA). Accompanied by a €200 million fine, the decision concluded that Meta’s approach failed to comply with Article 5(2) of the DMA. Importantly, the Commission’s decision does not extend to Meta’s revised offer, which has been augmented with a free-of-charge “less personalized ads” option.

The Commission’s decision hinges on two determinations. First, Meta’s model, which offered users a binary choice between accepting personalized advertising through personal-data combination or paying a monthly fee for an ad-free experience, did not provide a “less personalized but equivalent alternative,” as required by the DMA—especially as interpreted through Recital 36. Second, this binary structure, along with the associated fee for the privacy-centric option, was deemed to be coercive and that it violated the General Data Protection Regulation’s (GDPR) “freely given consent” requirement, which is explicitly integrated into DMA Article 5(2).

In this post, I’ll try to reconstruct the Commission’s likely reasoning. It’s crucial, however, to state upfront that, without the full published decision text, we’re operating somewhat in the dark, relying on the Commission’s press release and inferring connections to broader regulatory discussions. Of particular interest, in regard to the latter, is the European Data Protection Board’s (EDPB) recent opinions on “pay or consent” under the EU GDPR. This inherent uncertainty must be kept in mind.

Lack of ‘Freely Given’ Consent

Article 5(2) of the DMA demands GDPR-standard consent for the kind of data combination and cross-use that Meta employs for personalized advertising. The Commission’s announcement explicitly stated that Meta’s model “did not allow users to exercise their right to freely consent.”

The uncertainty lies in how, exactly, the Commission reached this conclusion under the DMA. It seems probable they leaned heavily on the reasoning laid out in the EDPB’s Opinion 08/2024 regarding “consent or pay” models under the GDPR (I commented on that opinion here and here). The EDPB strongly insisted that, for “large online platforms,” a binary choice between consent and paying a fee is likely coercive, due to power imbalances and potential detriment, thus invalidating consent.

Directly transposing this quite-restrictive GDPR interpretation (which is itself quite debatable, especially regarding detriment) onto the DMA requires careful justification. While the DMA references GDPR consent, it doesn’t automatically incorporate every aspect of the EDPB’s subsequent guidance. In particular, it does not incorporate guidance that arguably stretches the concept of “freely given” beyond what the Court of Justice of the European Union (CJEU) outlined in Meta Platforms v Bundeskartellamt (see my commentary here and here).

The CJEU specifically acknowledged the possibility of valid consent—even when dealing with a dominant undertaking—and allowed for a fee-based alternative. So, the Commission’s finding of a lack of freeconsent under the DMA likely relies on accepting the EDPB’s premise that the binary choice is inherently coercive for gatekeepers, a point which remains legally contested.

Failure to Provide a ‘Less Personalised but Equivalent Alternative’

The Commission also found that Meta “did not give users the required specific choice to opt for a service that uses less of their personal data but is otherwise equivalent.” This points directly to the language in Recital 36 DMA, which calls for such an alternative as a prerequisite to enable free choice under Article 5(2).

The crux of the issue here seems to be the paid nature of the ad-free alternative Meta offered from March to November 2024. The Commission appears to have interpreted “equivalent alternative” under the DMA as requiring a free option that uses less personal data (perhaps funded by contextual ads, as the EDPB suggested for GDPR compliance).

This is, frankly, a problematic interpretation if it’s indeed the Commission’s definitive stance. Again, the CJEU in the Meta case explicitly allowed for an equivalent alternative under GDPR “if necessary for an appropriate fee.” While the DMA aims for contestability and fairness, neither Article 5(2) nor Recital 36 explicitly mandates that the “equivalent alternative” must be free of charge. Recital 37 focuses on ensuring the alternative isn’t of “degraded quality,” unless unavoidable due to lack of data. It doesn’t directly address the payment model.

Requiring a free-of-charge alternative seems less like a direct application of the DMA text and more like an adoption of the policy preference the EDPB expressed in its GDPR guidance. It effectively means the Commission might be using the DMA to impose a specific business model (free of charge and contextually ad-supported) rather than simply enforcing the stated rules.

From my analysis of “pay or consent” under GDPR, the focus should be on whether the fee is “appropriate” (as per CJEU) and whether consent is genuinely free under the circumstances, not on whether a free-of-charge option exists per se. If the Commission’s DMA reasoning mandates the alternative be free, it represents a significant, and legally questionable, step beyond established principles.

Conclusion

While the Commission fined Meta, citing lack of free consent and a failure to provide an equivalent alternative under DMA Article 5(2), the precise legal steps in their reasoning remain unclear without the full decision. It appears highly likely that they’ve heavily relied on the EDPB’s restrictive interpretation of “consent or pay” under GDPR, potentially extending it to the DMA context.

Specifically, the apparent requirement for a free-of-charge equivalent alternative seems particularly contentious. It arguably goes beyond both the DMA’s text and the CJEU’s guidance on GDPR, raising concerns about whether the Commission is enforcing the law as written or imposing a preferred market outcome.

Until the full reasoning is public and potentially tested in court via Meta’s likely appeal, the exact legal basis and its broader validity remain uncertain. I remain critical of interpretations—whether under GDPR or seemingly now under DMA—that would effectively prohibit established “pay or consent” models outright by demanding a free alternative, where the law and higher courts have explicitly allowed for appropriate fees.

[Previously published on Truth on the Market on 23 April 2025]