Meta Given Deadline to Address EU Concerns Over 'Pay or Consent': Privacy Implications and the Indian Legal Framework

Introduction: The Battle Over 'Pay or Consent'

Global digital privacy entered a critical phase when European Union regulators set strict deadlines for Meta Platforms Inc. to address competition and privacy violations stemming from its controversial "Pay or Consent" model. Under this architecture, European users of Facebook and Instagram were forced to make a binary choice: either pay a recurring monthly subscription fee for an ad-free service or "consent" to having their personal data tracked and monetised for hyper-targeted behavioural advertising.

European regulators, spearheaded by the European Data Protection Board (EDPB) and the European Commission under the Digital Markets Act (DMA), concluded that this binary choice undermines genuine user autonomy. Forcing users to pay to protect their fundamental right to privacy fails the legal test of freely given consent.

While this regulatory showdown is unfolding in Brussels, its ripples are felt across global tech corridors, directly impacting Indian users, data fiduciaries, and digital enterprises. In this article, APS Law examines the mechanics of Meta’s model, evaluates how Indian data protection law—primarily the Digital Personal Data Protection Act, 2023 (DPDP Act)—treats forced consent, and details the cyber legal remedies available to citizens across Mumbai, Thane, and Mira Road.

---

Understanding the 'Pay or Consent' Model

In late 2023, Meta introduced a model in the European Economic Area requiring users to pay upwards of €9.99 to €12.99 per month if they opted out of tracking cookies and cross-platform profiling. If they refused to pay, they had no alternative but to click "Agree" to extensive commercial surveillance.

Regulators challenged this framework on several grounds:

• Absence of Genuine Choice: Privacy is a fundamental human right, not a commodity to be bought or surrendered due to financial constraints.
• Significant Power Imbalance: Dominant digital platforms enjoy lock-in effects. Users cannot simply abandon social networks tied to their personal and professional networks without suffering social and commercial detriment.
• Dark Patterns and Coercion: Structuring options so that rejecting surveillance incurs an ongoing economic penalty constitutes a coercive "dark pattern" designed to compel consent.

European regulators directed Meta to offer an equivalent, privacy-respecting alternative that does not penalise users who refuse behavioural tracking.

---

The Indian Context: DPDP Act, 2023 and the Legality of Forced Consent

As India transitions into enforcing the Digital Personal Data Protection Act, 2023 (DPDP Act), multinational platforms operating in Mumbai, Bengaluru, and across the country must align their terms of service with statutory Indian standards.

1. The Mandate of Section 6 (Consent)

Under Section 6(1) of the DPDP Act, 2023, consent given by a Data Principal must satisfy four cumulative criteria:

• Free
• Specific
• Informed
• Unconditional and unambiguous, demonstrated through a clear affirmative action.

Crucially, Section 6(1) explicitly states that consent cannot be tied to the provision of any goods or services if the processing of personal data is not strictly necessary for that service. If a social networking platform can operate effectively without behavioural cross-site tracking, conditioning access on profiling consent or levying a prohibitive financial penalty renders the consent conditional, directly contradicting Section 6.

2. Prohibition of Deceptive Design Practices (Dark Patterns)

In late 2023, the Central Consumer Protection Authority (CCPA) under the Ministry of Consumer Affairs notified the Guidelines for Prevention and Regulation of Dark Patterns. These guidelines prohibit commercial interfaces from deploying:

• Forced Action: Compelling consumers to take an action that requires them to buy additional services or share personal data to access the core functionality.
• Confirm Shaming & Subscription Traps: Guilt-tripping or financially cornering users into relinquishing their digital privacy.

Any global technology company attempting to introduce a coercive "pay or track" model in India risks running afoul not only of the DPDP Act but also the Consumer Protection Act, 2019.

---

Data Misuse, Cyber Risks, and the Indian Criminal Law Framework

Forced data collection creates vast, central repositories of behavioural, location, and demographic data. When big data pools are breached, leaked, or shared with shadowy data brokers, users face immediate cyber risks including identity theft, targeted social engineering, financial fraud, and digital impersonation.

Where personal data is harvested or abused deceptively, several provisions of Indian cyber and penal law are engaged:

1. Information Technology Act, 2000 (IT Act)

• Section 43A: Mandates that corporate bodies handling Sensitive Personal Data or Information (SPDI) maintain reasonable security practices. Failure resulting in wrongful loss attracts civil compensation.
• Section 66C: Imposes criminal penalties for identity theft—using unique identification features of another person fraudulently.
• Section 66D: Punishes cheating by personation using computer resources.
• Section 72A: Imposes criminal liability on entities that disclose personal data in breach of a lawful contract without consent.

2. Bharatiya Nyaya Sanhita, 2023 (BNS)

Following criminal law reforms, the BNS penalises digital deception and data-driven fraud:

• Section 318 of BNS (Cheating): Covers deceptive inducements made electronically to procure consent or extract economic consideration.
• Section 319 of BNS (Cheating by Personation): Relevant when harvested data is used to orchestrate synthetic identity fraud and deepfake scams.
• Section 316 of BNS (Criminal Breach of Trust): Applicable when a custodian of digital records misappropriates confidential data entrusted to them.

3. Bharatiya Nagarik Suraksha Sanhita, 2023 (BNSS)

Procedurally, Section 173 of the BNSS governs the registration of First Information Reports (FIRs) for cognizable cyber offences. Victims can register an e-FIR directly through authorised digital platforms or their local police cyber cells.

---

Practical Guide: Reporting Data Abuse and Cyber Offences in Mumbai, Thane, and Mira Road

If you discover that your digital credentials, personal data, or payment details have been harvested, compromised, or exploited in financial cybercrime, immediate legal and procedural intervention is vital.

Step 1: Immediate Digital Quarantine and Evidence Capture

• Take clear, timestamped screenshots of coercive pop-ups, unauthorized debits, or breach notifications.
• Export system activity logs and retain communication emails/SMS.
• Do not alter the compromised device’s cache or delete transaction chains, as these serve as admissible digital evidence under the Bharatiya Sakshya Adhiniyam, 2023 (BSA).

Step 2: National Cyber Crime Reporting

• Call the National Cyber Crime Helpline at 1930 immediately to register financial fraud cases within the golden hour to freeze illicit transactions.
• File a detailed complaint on the central portal: cybercrime.gov.in.

Step 3: Local Jurisdiction Reporting (Mumbai Metropolitan Region)

Residents of the Mumbai Metropolitan Region (MMR) can escalate complaints directly to dedicated cyber police cells:

• Mumbai: The Mumbai Police Cyber Cell operates across specialized regional units (South, Central, Eastern, Western, and Northern Zones), with the apex nodal centre located at the Bandra-Kurla Complex (BKC) Cyber Police Station.
• Thane: The Thane Cyber Crime Police Station, located near the Commissioner of Police Office, manages investigations relating to identity theft, IT Act violations, and online commercial fraud.
• Mira Road & Bhayandar: Fall under the Mira-Bhayandar Vasai-Virar (MBVV) Police Commissionerate. Victims should approach the MBVV Cyber Crime Police Cell situated at Mira Road/Bhayandar for specialized investigation and prompt FIR registration under the BNSS.

---

Frequently Asked Questions (FAQs)

1. What does the term 'Pay or Consent' mean?

It refers to a digital service architecture where users must either pay a recurring fee to avoid tracking or submit to tracking and targeted advertising if they want free access. Regulators argue this undermines free consent.

2. Can platforms legally launch a 'Pay or Consent' model in India?

Under Section 6 of the DPDP Act, 2023, consent must be unconditional and unbundled from the delivery of a service unless the data processing is strictly indispensable. Furthermore, Indian dark pattern regulations prohibit forced actions. Platforms attempting a strict "pay or be tracked" strategy face strong legal challenges in India.

3. What should I do if a platform shares my personal data without consent?

You can issue a formal grievance notice to the Data Protection Officer (DPO) of the respective company. If unresolved, you may file a complaint with the Data Protection Board of India (once operational) and seek remedies for breach of contract or violation under Section 43A and Section 72A of the IT Act, 2000.

4. Which police station handles cybercrime complaints in Mira Road?

Residents in Mira Road and adjoining areas fall under the jurisdiction of the Mira-Bhayandar Vasai-Virar (MBVV) Police Commissionerate. Cybercrime complaints should be filed with the MBVV Cyber Police Station or reported online via the National Cyber Crime Reporting Portal.

---

Legal Advisory & Support: APS Law

As data privacy standards mature globally and domestically, individuals and businesses must navigate complex compliance obligations and cyber threats. APS Law provides strategic counsel and litigation support across Mumbai, Thane, and Mira Road, advising clients on data protection, corporate IT compliance, cyber fraud litigation, and digital rights enforcement.

If your organization requires compliance advisory under the DPDP Act, or if you are dealing with cyber fraud or data misuse, contact APS Law today to request an initial legal consultation.