In the digital economy, personal data has become a valuable asset, challenging traditional notions of free digital services. The proliferation of data-driven busi- ness models, fueled by behavioral advertising, raises complex questions about privacy, consent, and the balance between economic growth and individual rights. The launch of Meta’s “Pay or Consent” model in 2023 exemplified these issues, offering users a choice between paying a subscription fee or consenting to data processing for targeted advertising. Following criticism from the EDPB, Meta withdrew this model but reintroduced a modified version in November 2024. This updated model sought to address regulatory concerns while retaining the core pay-or-consent framework, reigniting debate over its compatibility with GDPR’s requirements for valid consent.

This thesis provides a systematic analysis of GDPR’s legal requirements, relevant case law, and the EDPB's opinions on “Pay or Consent” models. It evaluates whether Meta’s new model complies with the GDPR framework for consent, and examines how the concept of consent aligns with GDPR’s dual objectives of safeguarding privacy rights and fostering a competitive internal market. Furthermore, it explores whether current consent frameworks sufficiently protect individuals’ rights to privacy and data protection.

The findings of the thesis demonstrate that current consent mechanisms, rather than functioning as effective privacy safeguards, often serve to legitimize extensive data processing practices. The thesis also highlights the risks of behavioral advertising, as well as how lock-in and network effects in digital platform services can transform optional services into practical necessities, questioning whether the EU's framework adequately protects the individual ́s privacy rights. Lastly the thesis proposes possible solution that addresses these issues, based on the overarching aims and purposes of the GDPR.