Clifford Chance

The economic value of personal data is no secret to businesses, nor to Italian courts and government bodies.

Data monetisation practices of online service providers have already come under legal scrutiny in the past, most notably following the decision by the Italian Administrative Court for Lazio that Facebook's use of users' personal data for commercial purposes breached consumer protection law (Tribunale Amministrativo Regionale del Lazio decision no. 261 published on 10 January 2020, the "Facebook Decision"). Whilst the Facebook Decision stemmed from a fine imposed by the Italian Competition Authority and thus focused on consumers' right to being properly informed as to how their data is being used to make informed commercial decisions, it did confirm that both consumer and competition law and data protection law play a role in protecting users' rights in respect to use of their personal data.

Now the Italian Data Protection Authority ("DPA") has turned its attention to a practice that is becoming increasingly popular among online newspaper publishers and media outlets: in order to be able to access online content, users are being asked to either sign up to a paid subscription (paywall) or agree to the use of cookies or other data analytics tools (cookie wall).

In a series of press releases in October and November 2022, the DPA stated that, in principle, EU data protection law does not preclude content providers from conditioning access to their online content on either payment or consent to personal data processing for profiling purposes (e.g. through cookies). Nonetheless, a series of investigations have been opened into such practices adopted by online publishers and content providers (whose names have not yet been made public), in particular as regards fairness and transparency of processing, freedom of consent, as well as the criteria used to determine the pricing of the subscription.

As noted with reference to the Facebook Decision, while social networks, search engines and gaming platforms may be free of (monetary) charge, this by no means implies that they are cost-free: data is the consideration. Moreover, this is now acknowledged under Italian law with the latest amendment to the Italian Consumer Code, in force as of 1 January 2022 (see our overview of the main implications).

The paywall vs. cookie wall dilemma highlights that online content providers consider users' personal data as an alternative to monetary consideration and are using consent to personal data processing for commercial purposes as a bargaining chip for providing online products and services.

The DPA's investigations into the paywall vs. cookie wall dilemma are still ongoing and we expect that the outcome will shed new light on the opportunities and risks of monetising personal data for online content providers operating in the EU.