The Austrian privacy organization Noyb has sued the data protection authorities (DPAs) of Hesse and North Rhine-Westphalia for failing to rule on the “Pay or Okay” business model used by several German news outlets.
Back in August 2021, Noyb filed several complaints against two news websites for unlawfully implementing the Pay or Okay business model.
When visiting the websites, users had to immediately decide whether to allow the sites to process and share their personal data for ad tracking, or to opt for a paid subscription to have their privacy respected.
According to Noyb, a minority of 3% to 10% of all visitors agree to being tracked for personalized ads. However, Pay or Okay systems lead to consent rates of more than 99%. These numbers show consent isn’t given freely, which is explicitly required by the General Data Protection Regulation (GDPR).
After communicating back and forth between Noyb and the privacy regulator from North Rhine-Westphalia, the Austrian privacy organization received a final decision from the DPA in May 2025. In a 12-page document, the supervisor argued that it couldn’t make a final decision yet.
The Hessian DPA didn’t issue a final decision either, citing the complexity of the case and the possibility that new guidelines could be introduced in the future.
“It is obvious that Pay or Okay systems do not offer the option of ‘freely given’ consent. Despite this, the data protection authorities in Hesse and North Rhine-Westphalia appear to have no interest whatsoever in applying the GDPR consistently. This is highly questionable,” Felix Mikolasch, data protection lawyer at Noyb, says in a statement.
“Your privacy and data protection rights should not have a price tag. When 99.9% agree to something, but only 3% actually want it, it is clear that they had no free and genuine choice. Unfortunately, such obvious inactivity seems like pure political unwillingness to enforce the GDPR against media companies,” Noyb Chairman Max Schrems commented.
To turn things around, Noyb has decided to sue the privacy regulators of Hesse and North Rhine-Westphalia. The privacy advocacy group has filed two lawsuits with the Administrative Courts of Wiesbaden and Düsseldorf. If the courts agree with Noyb, the DPAs will have to decide and uphold the initial complaints.
Your email address will not be published. Required fields are markedmarked