Why are websites asking you to pay or consent? Reason for message and what law around cookies says

• Users of major UK sites may have noticed ‘pay or consent’ pop-ups this summer. 
• Message urges you to accept cookies or pay a monthly fee instead. 
• The Information Commissioner’s Office has launched a ‘call for views’ on the practice. 

A new pop-up message has been appearing on leading UK websites urging people to accept cookies or pay a monthly fee to reject them. For the online savvy, it may have set off alarm bells and led you to fear it could be a new form of phishing or ransomware scam but it is in fact legit - if slightly eyebrow raising. 

Regulators across the globe (including in the British Isles) have been clamping down on cookie compliance and making sure consumers have adequate options. In the EU, Meta has been accused of breaching digital law by charging for ad-free social media experience. 

But why have these pay or consent messages suddenly started to appear? And are they going to be allowed to continue? Here’s all you need to know: 

Why are websites asking you to pay or consent? 

If you’ve visited a number of popular websites recently, you may have been confronted with a pop-up asking you to consent to cookies or pay a monthly fee (differing depending on the website). The messages started to appear and be noticed over the summer but you may not have clocked them at first. 

The Press Gazette reports that in the message on The Sun’s website it explains: “In response to recent enforcement action by the UK Information Commissioner (ICO) against publishers, we have been forced to introduce new technology to ask our subscribers to consent to the advertising cookies that support our journalism, or pay a monthly fee that means we don’t need to use them.”

The Information Commissioner’s Office (ICO) has launched a “call for views” on the practice. Stephen Almond, Executive Director, Regulatory Risk, wrote: “In our call for views, we highlight the things that organisations should take into account when considering if this model is right for them and their users. We invite publishers, advertisers, intermediaries, civil society, academia and other interested stakeholders to respond and help inform our position.”

Which websites are doing it? 

So far, we have spotted the pay or consent message appearing on websites including: Daily Mail, The Sun, Mirror Online, Express and the Independent. Have you noticed the message on any other websites, email me - [email protected]. 

What is the current law around cookies 

For those reading this article who live in the UK, there are two main laws surrounding the policing of personal information online. The one you may recognise by name alone is the General Data Protection Regulation - more commonly known as GDPR - this is a law from the EU which came into force in 2018, prior to Brexit. 

Under the law - also known as the Data Protection Act 2018 - everyone responsible for using personal data has to follow strict rules called 'data protection principles'. They must make sure the information is: used fairly, lawfully and transparently.

The second, perhaps less commonly known law, is the Privacy and Electronic Communications Regulations (PECR). The Information Commissioner’s Office explains that the PECR gives people specific privacy rights in relation to electronic communications.

Do websites have to give you a choice when it comes to cookies? 

The guidance on the ICO’s website explains: “You must tell people if you set cookies, and clearly explain what the cookies do and why. You must also get the user’s consent. Consent must be actively and clearly given.

“There is an exception for cookies that are essential to provide an online service at someone’s request (e.g. to remember what’s in their online basket, or to ensure security in online banking). The same rules also apply if you use any other type of technology to store or gain access to information on someone’s device.”

Stephen Almond adds: “Meanwhile, our crackdown on websites that do not offer people a fair choice continues. We have seen an almost 80% success rate in effecting change from the 53 organisations we wrote to last year. 

“We are now preparing to write to the next 100 most frequented websites. Meanwhile, we are developing digital tools to evaluate website cookie compliance at scale, building on the successful hackathon we held with technical experts last month.

“Where organisations ignore the law, they can expect to face the consequences. We are reviewing responses received from organisations that have not made changes and determining which cases to prioritise for enforcement action.

“This is the last chance to change. Our next announcement in this space will be about enforcement action.”

What do you think of the ‘pay or consent’ message, have you forked out or just hit accept? Share your thoughts with our tech writer by emailing [email protected]. Share any other tips for technology stories with him as well.