The following is the text of a speech delivered by Giulio Uras at the panel discussion “Pay or Okay and data monetisation: where do we stand? Developments and prospects for data exploitation”, as part of the Privacy Symposium 2026.
As you know, a number of business models are based on Consent or Pay mechanisms – indeed, they depend on such mechanisms. This is particularly true of the online publishing sector: newspapers fund their journalism through advertising revenues.
You will also be familiar with the legal issue these models have raised for years: the requirement that consent be freely given.
According to supervisory authorities, consent is not freely given – and is therefore invalid – if the alternative offered to users, namely paying, effectively pushes them to consent. This approach is consistent with Article 7 of the GDPR and with how it is strictly interpreted by the European Data Protection Board.
I have to admit that, after years of debate, I am still not sure what this so-called “equivalent alternative” – which would ensure free consent – is supposed to look like. But I don’t think I’m the only one. After all, it is easy to argue that charging €1.99 a month may influence a user’s choice. It is far harder to identify a genuinely viable alternative that would not.
And while we were debating this – that is to say, the price of consent – the European Commission reframed the debate.
With the Digital Omnibus, the legislator acknowledges something we all know: users do not read cookie banners, do not fully understand what they are agreeing to, and tend to give consent simply in order to fully access content that would otherwise be blocked by the presence of such banners.
In other words, consent is not the result of a genuinely free and informed choice.
To address this problem, the proposal introduces automated signals: technical tools that allow users to express their preferences once and for all without having to interact with cookie banners every time. Data controllers are required to implement tools capable of reading and complying with these signals.
In a sense, this represents an attempt to move beyond consent as we have known it until now.
But – and this is where the debate becomes particularly interesting – the legislator introduces an exception: media service providers, when offering media services, are not required to comply with those signals.
And there is no technical justification for such an exemption. The reason is economic: the aim is to preserve publishers’ ability to interact directly with users to obtain their consent and, in doing so, to safeguard the revenue streams that support independent journalism, which is considered a pillar of democratic society.
Now, on the one hand, the European legislator tells us that the cookie banner system is ineffective, creates fatigue - the fatigue associated with consent - and does not lead to genuinely informed decisions.
On the other hand, it has decided to maintain – and indeed to protect – it precisely in the media sector.
This raises an obvious question: how can we, at the same time, acknowledge that the mechanism is structurally inadequate for obtaining free consent, yet continue to base the validity of such consent on that very mechanism?
Perhaps the answer is simpler – and more uncomfortable – than we have been willing to admit so far.
Perhaps it is time to openly acknowledge that Consent or Pay, in its current form, has limitations. That the user’s choice is inevitably influenced. That consent, in these contexts, can never be entirely free from influence.
But that does not automatically make it unlawful.
Because another consideration comes into play: the need to strike a fair balance.
The right to the protection of personal data, after all, does not exist in a vacuum. It coexists with other rights and freedoms: freedom of expression, freedom of information, and freedom of enterprise.
The point is not to question the fundamental nature of the right to personal data protection. Rather, it is to recognise that, in a constitutional system, even fundamental rights can come into conflict and must be balanced.
And here, in my view, the Digital Omnibus marks a significant shift.
It does not say that personal data is a commodity.
It does not say that the right to data protection can be waived.
But it goes a step further by recognising that when sufficiently significant interests are at stake, which are structural and democratically justified, balancing is not only possible, but legitimate.
And it does so through an express legislative provision, not through a doctrinal construct.
This, inevitably, has significant implications.
Because it makes it harder to sustain an absolutist approach, such as that expressed by the European Data Protection Board itself, according to which personal data can never become the object of commercial exchange or be made subject to conditionality.
The emerging regulatory landscape is more nuanced.
So perhaps the real question is no longer: “Can data have a price?”. But rather: “What interests justify it having a price under certain conditions?”.
And above all: who decides where to strike this balance?
The European legislator, certainly.
The supervisory authorities, through their interpretation.
The courts, in concrete cases.
And, to some extent, the market itself – although market forces alone cannot determine the outcome.
Otherwise, there is a clear risk that the balance will gradually slip into commodification.
So, in my opinion, this is the real issue on which the debate must now focus: the framework of values that the European system is building.
If the exemption for the media is justified by the democratic importance of journalism, what other economic interests can lay claim to the same status?
I am thinking of the sustainability of digital platforms, technological innovation, access to digital services, and scientific research.
The open question remains where to draw the line between a legitimate balance and a gradual erosion of a fundamental right.
Much, in my view, depends on the interplay between the Digital Omnibus and Consent or Pay.
And perhaps that is why Consent or Pay is no longer simply about consent.
It has become the place where a much broader question is being decided: what kind of relationship European law should establish between fundamental rights and the data economy.
