- Pay-or-consent model raises important questions about whether South African law can adequately protect consumers.
- Consent only meaningful when users can refuse unnecessary data processing without suffering consequences.
- Users who reject collection of personal information must be provided with accessible, affordable alternatives.
-
Legal framework must be strengthened to avoid privacy becoming a luxury rather than a right.
Many people are familiar with being asked to accept cookies or agree to the collection of their personal information when using online platforms. But what happens when the choice is to either pay for privacy or consent to even more extensive data collection? Should we have to pay money to protect our privacy or surrender our personal information to use these platforms?
According to research by Stellenbosch University (SU) legal scholar Zinhle Novazi, the pay-or-consent model, also known as the pay-or-okay model, raises important questions about whether South African law can adequately protect consumers.
Novazi focused on platforms operated by Meta, which introduced such a model for Facebook and Instagram in Europe in 2023. She says that because Meta’s subscription model was introduced specifically in Europe, her paper looks ahead to what could happen if a similar model were introduced in South Africa, that is, whether our law would be capable of regulating it.
The findings of her study were published in the Stellenbosch Law Review in December 2025.
“The legality of the pay-or-consent model depends on whether users are given a genuine and fair choice, and whether the model complies with data protection, consumer protection, competition and contract law.
“Consent is meaningful only when a person can refuse unnecessary data processing without suffering exclusion, disproportionate financial consequences or the loss of essential digital connections.”
Novazi says her study does not argue that platforms should be prevented from charging for their services. Rather, it asks whether users who don’t want their personal information collected and used in this way are offered a genuinely accessible, affordable alternative that provides the same service. If not, the choice they are given may be more of an illusion than a real choice.
Novazi adds that the common law of contract is also limited.
“Courts generally require proof that someone was unlawfully pressured into agreeing to a contract and have been reluctant to invalidate agreements solely because one party had more bargaining power.“Although public policy, good faith and constitutional rights may be used to challenge unfair terms, the courts have traditionally been cautious about applying these principles.”
Novazi points out that consent is not always as voluntary as it appears. She explains: “A user may be presented with two buttons, but that does not mean the alternatives are practically accessible or equivalent.
“Many users have spent years building networks, storing photographs, developing business pages and maintaining personal or professional relationships on platforms such as Facebook and Instagram.
“Network effects make it difficult to move to another platform because the value of the service lies partly in the fact that other people are already using it. Refusing consent may therefore mean losing access to an established community, audience, livelihood or digital identity.
“The paid alternative may also be unaffordable, particularly in a country with high levels of economic inequality where the choice may be to surrender your personal information or accept digital exclusion. Users may technically consent, but do so under significant economic and structural pressure.”
Novazi says South Africa can learn from the European Union (EU), which has developed a more detailed and integrated legislative response to the model. “In Meta Platforms v Bundeskartellamt, the Court of Justice of the EU held that personalisation does not make extensive data collection contractually necessary unless it is objectively indispensable to the service.
Novazi emphasises the importance of strengthening POPIA with clearer binding regulatory guidance on pay-or-consent models and of making it clear that the CPA should also apply when consumers provide their personal information instead of money to access a service.
“Platforms should not be allowed to combine behavioural advertising, sharing of personal information with other companies, service improvements and cross-platform tracking into a single request. Users should be able to refuse unnecessary data collection without losing access to the core service.
“Large platforms should be required to offer a free alternative that provides the same service without relying on behavioural advertising. If they do offer a paid option, its price should be clear and affordable. Claims that a service is ‘free’ should disclose how users’ personal information will be used.”
Novazi warns that if South Africa doesn’t strengthen its legal framework, privacy could gradually become a luxury rather than a right, forcing lower-income users to exchange their personal information to use online platforms.
She calls for closer collaboration between the Information Regulator, Competition Commission and consumer-protection authorities to address digital inequality and exploitation.
