The overlooked implications of Meta’s EDPB consent-or-pay opinion challenge

EDPB opinions, while not binding, are nonetheless procedurally significant and could still be reviewed, on the merits, by the CJEU directly in the future

The order of the General Court in case T-319/24, dismissing Meta’s action for annulment of EDPB’s Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms, as well as its request to be compensated for the alleged damage, was entirely expected. As I noted previously, the case is frivolous and was always destined for dismissal, with the pleas in law Meta relied on providing for a good laugh. The action was dismissed, in part, due being inadmissible and, in part, because it manifestly lacked any foundation in law. Ouch! However this is not a recap of the order, which you should read if you’re interested further (it’s not that long), just my observations that I don’t think others have touched upon.

Not binding but to be taken into account?

Most of the order deals with the fact that EDPB opinions are not binding, something that Recital 143, though not mentioned by the court in its analysis of the type of act is it, indicates:

[…] However, the right to an effective judicial remedy does not encompass measures taken by supervisory authorities which are not legally binding, such as opinions issued by or advice provided by the supervisory authority. […]

In arguing its pleas of non-admissibility, the EDPB claimed that Article 64(2) opinions, which includes its consent-or-pay opinion, are not binding and must only be taken into utmost account by the DPAs that request them. But the General Court rejects even that proposition:

28. Contrary to the submissions of the EDPB, Regulation 2016/679 does not contain any provision requiring supervisory authorities to ‘take utmost account’ of an opinion under Article 64(2) thereof. The obligation to ‘take utmost account’ of an opinion of the EDPB, set out in Article 64(7) of Regulation 2016/679, applies to opinions issued under Article 64(1) thereof, which relate not to general matters but to certain specific types of draft decision of the supervisory authorities that those authorities must communicate to the EDPB during the procedure for the adoption of those decisions. If the supervisory authority concerned does not intend to follow, in whole or in part, the opinion issued to it under that provision, it must notify the Chair of the EDPB thereof, which triggers the process for the adoption of a binding decision of the EDPB, as provided for in Article 64(8). No such rules are laid down in relation to opinions of the EDPB on general matters issued under Article 64(2) of Regulation 2016/679, such as the contested opinion. Those are therefore opinions to which no special authority is attached.

The bare statutory text seems to support this conclusion, though it is perhaps not exactly consistent with what the court says just a few paragraphs down, as we’ll examine in a moment.

Meta was also told by the DPC that, in its view, it must take account of the opinion based on Article 57(1)(g), however, as the General Court points out, this does not render the opinion binding on Meta. Nonetheless the court seems to leave the door open for this provision to require the opinion to be taken “into consideration”, just not "utmost account" of I suppose¹.

In that regard, the fact – to which Meta referred – that the Irish Data Protection Commission informed Meta that, in its view, it was required to take account of the contested opinion, relying on Article 57(1)(g) of Regulation 2016/679, under which each supervisory authority is to cooperate with the other supervisory authorities with a view to ensuring the consistent application of that regulation, cannot endow the contested opinion with a binding force which it does not have per se and which the obligation to cooperate in question does not confer on it either. An obligation to cooperate in order to implement a harmonised policy within the European Union cannot make non-binding acts of the European Union binding, even if those acts must be taken into consideration (see, to that effect and by analogy, judgment of 13 February 2014, Mediaset, C‑69/13, EU:C:2014:71, paragraphs 27 to 32).

Not following opinions comes at a cost

Nevertheless, should any DPA (not just the requesting DPAs) choose to depart from an EDPB opinion — in this case being either more permissive or restrictive on the legality of consent-or-pay models — or departing from the legal underpinnings of the opinion in its draft decision, it or any concerned DPA or the Commission are obligated to trigger the dispute resolution mechanism under Article 65(1)(c).²

It actually hadn't dawned on me until now how far-reaching consequences of this may be. As far as I can tell this obligation to trigger the dispute resolution mechanism applies to all cases handled by DPAs, not just cross-border ones.

Even though in principle only large online platforms the scope of the consent-or-pay opinion, its legal analysis is generally applicable and should in principle be addressed whenever the issue of consent-or-pay arises.

This is quite worrying given just how divorced from (legal) reality the opinion is and would result in the consent-or-pay model spreading everywhere like wildfire, which I’ve discussed previously.

Unfortunately there is no mechanism for the rescission of a request for an opinion or an already adopted opinion so these effects will apparently persist unless superseded by a different opinion that (perhaps explicitly) overrides it.

In principle, the EDPB doesn't have to follow its opinions and could change its mind in the binding decisions it adopts. Although opinions can be adopted with a bare majority, a two-third majority (or just a majority if there's no agreement for a while) is required in the dispute resolution process. Therefore, especially given the contentiousness of the topic of consent-or-pay among the DPAs, an individual DPA may have more latitude to adopt decisions that better fit its position while not upsetting the other DPAs so much that a (two-thirds) majority decides against it.

Still, having to go through the trouble of triggering the dispute resolution mechanism and likely having to explain its divergent reasoning (including before the national courts) may nudge the DPAs towards toeing the EDPB line. It raises the (political) cost of pursuing and handling consent-or-pay cases. Failure to follow this Article 65(1)(c) obligation could perhaps be considered a substantial procedural defect and lead to the annulment of the final decision.

EDPB opinions not necessarily isolated from challenge

But there is a further twist. Although Meta’s direct action was always destined for failure, the preliminary reference procedure, as is very often the case, differs significantly. Under settled case law, the CJEU will entertain, on the merits, a request for a preliminary ruling on the question of the validity of all acts of EU institutions, including those that do not produce legal effects, which also encompasses non-binding guidance documents.

Meta, other controllers (especially news publishers) as well as data subjects may, when challenging DPA decisions or in other judicial proceedings³, ask the national court to refer a question on the validity of the opinion to the Court of Justice. However it’s unclear if there will be any willingness to do so given that what national courts are likely to be interested in first and foremost is what the law actually says, not if an EDPB opinion is right about what it says.

In principle DPAs also could challenge EDPB opinions they do not like in the context of the aforementioned national proceedings. Aside from this avenue, there is an additional question of whether they are open to challenge by the DPAs before the CJEU in an action for annulment. The same procedural hurdles apply as in Meta’s case. As the order notes:

29. […] However, in both cases, the opinion adopted under Article 64(2) of Regulation 2016/679, like the contested opinion, is not in the nature of an act which is in itself binding, since it is only by means of a subsequent binding decision of the EDPB that the guidelines contained in that opinion may, having regard to the EDPB’s powers, where appropriate, later become instructions of mandatory application by the supervisory authorities. […]

While this is true with respect to the final decision of a DPA, it could perhaps be argued that an opinion produces binding legal effects procedurally within the context of Article 65(1)(c) which makes the triggering of the dispute resolution mechanism mandatory.

Perhaps the only somewhat defensible argument that Meta’s lawyers should have been making (and perhaps will on appeal) is that this is also why Meta should be allowed to challenge the validity of the opinion.

However even then that seems like a tall task because it’s questionable if these opinions and the internal DPA-EDPB procedures produce legal effects vis-à-vis Meta, meaning bringing about a distinct change in its legal position (a admissibility criterion also often found in national legal systems).⁴ That really only changes with the final decision, though that may of course be impacted by the EDPB binding decision which very likely is challengeable by the addressee of the final decision (e.g. Meta) as I believe the Court of Justice will likely follow the AG Opinion in case C‑97/23 P (another Meta case I talked about here). Perhaps this would depend on whether Meta would be able to argue a substantial procedural defect.

In any case, the existence of the opinion itself does not prevent the DPA in its draft decision and the EDPB in a possible binding decision from taking a legally correct position and departing from the opinion. The existence of the opinion that the DPA does not intend to follow merely necessitates the taking of a different procedural path to arrive at the final decision. Whoever gets its wrong can be challenged on it in national or EU court.

Assuming that Meta got through all of these barriers and the opinion was considered a challengeable act, they would still face other procedural hurdles. It seems pretty clear that Meta is not individually concerned by the opinion and cannot challenge it before it actually affects it in the context of proceedings, which cannot move forward anyway until the DPC comes up with a draft decision. The criterion of individual concern could however be set aside were the opinion be considered to be a regulatory act, which would need to only be of direct (but not necessarily individual) concern to Meta. However even such a regulatory act would need to not entail implementing measures. This and individual concern is where the story truly ends. In order for Meta to be directly concerned, the opinion would have to “leave no discretion to its addressees who are entrusted with the task of implementing it, such implementation being purely automatic and resulting from EU rules alone without the application of other intermediate rules” (AG Opinion in C‑97/23 P, para. 128). Since the DPA is not definitively bound by the opinion, departing from which is merely requires the triggering the dispute resolution mechanism, it is quite obvious that discretion is left to the DPAs which adopt the final decisions.

What remains

Meta also wanted compensation for the damage the EDPB had caused it, which the court dismissed as manifestly unfounded by ruling on the merits (in the interest of procedural economy) without even touching on admissibility. Because the forms of order sought were rejected early in the process, that also meant that the court did not examine Meta’s other pleas, including that Article 64(2) is invalid, which is also the reason the Council decided to intervene.

Of note is that the General Court has also recently ruled in case T-391/23, on the Union’s non-contractual liability, stating that a national court interpreting a non-binding opinion as binding does not create an entitlement to damages.

Conclusion

It may be that this will all amount to nothing. After all, over the years the EDPB has issued a large number of opinions, and I’m sure the DPAs aren’t aware and thinking of all of them. They probably haven’t been following these opinions religiously and triggering the dispute resolution mechanism where they should have, nor have they seen themselves lose in court for this reason. Therefore it’s likely that they will maintain their present course unless this becomes something that is more vigorously highlighted by outside parties.

In a previous blogpost I talked about how EU data protection guidance could be improved on a systemic level by eliminating duplication and divergencies. That blogpost is focused on guidance on a more general level and while this blogpost is about individual cases applying that guidance, the aforementioned Article 65(1)(c) obligation to trigger the dispute resolution mechanism in case of EDPB disobedience may also push the DPAs towards harmonizing their own guidance. After all, if DPAs intend to toe the EDPB line, then there is little reason for them to indicate otherwise in their own guidance. Obligations applicable when handling individual cases may thus impact the generally applicable guidance documents where such obligations aren’t really in place in any meaningful fashion. But again, for this to work, outside parties would need to start raising these issues with the DPAs more forcefully.

Perhaps the obvious test of the power of EDPB opinions will be whether the DPC — at least before this judgement already of the view that it must take account of the EDPB’s consent-or-pay opinion — decides to trigger the dispute resolution mechanism in case of divergence. I can only hope the reason the DPC is delaying a draft decision (for submission to the EDPB) on Meta's consent-or-pay practices, which the previous Commissioner Helen Dixon said was "imminent" in January 2024, is because the new leadership (unlike Dixon) doesn't want to give the model their unquestioning blessing. Fingers crossed.

It would've been easier to deal the consent-or-pay model a decisive blow (and conclude the Commission's initial DMA investigations) before Trump but now who knows how far the DPAs and the EDPB (beforehand already using a very conciliatory language), perhaps under EC pressure, are willing to go.

1. Whatever the difference between the two might be. As far as I’m concerned there isn’t any difference conceptually, just the degree of how seriously the DPA must address that opinion.

2. It’s actually not clear to me who must trigger the despite resolution mechanism but clearly the word shall in Article 65(1) indicates that someone must. However in practice it would most likely be the DPA that submitted the draft decision that departs from an opinion.

3. The question has to arise in some actual procedure, as the CJEU is generally unwilling to answers hypothetical questions, only those in an actual ongoing case or controversy. That said, this may not be limited to just challenges of DPA decisions. As those who have been keeping up with consent-or-pay discussions for a while surely know, the CNIL was — perhaps contra legem — forced by the Conseil d'Etat to rescind its cookie guidelines in the part where they banned the use of cookie paywalls. It is conceivable that parties in a similar challenge might ask the national court — which could also do the same sua sponte — to ask the CJEU certain questions about the interpretation and the validity of the EDPB opinion.

4. However AG Ćapeta in her opinion in the WhatsApp v. EDPB (C‑97/23 P) appeal — on whether EDPB binding decisions can be challenged in EU court — takes the position (see paras. 63-104) that whether an act is challengeable does not turn on it bringing about a distinct change in an applicant’s legal position, which is instead tied to the notion of direct concern, a wholly separate procedural hurdle. I’m skeptical the General Court is of the same mind (see para. 19 of the order).