The enormous VAT bill that Italian tax authorities have presented to Meta, based on the estimated value of the data that they have received from users in return for their services, has recently been in the news. Tax on personal data has the potential to deal quite a blow to the business model of online firms, particularly social media giants. But VAT is only due on payments, and whether data is a payment depends partly on whether it is voluntarily provided. One might think then, that firms would not want to exchange their services for data, because of the resulting tax bill. However, in their enthusiasm to extract maximum value from users, they seem to have been embracing consent-or-pay models which require users to provide either data or money. They are following the Court of Justice in Meta, which tentatively approved this, recognizing for the first time the possibility of data payment in EU law. While the judgment was viewed by many as a step back in privacy protection, it looks as if it may be a powerful tax weapon against internet giants who have hitherto been slipping through the cracks in VAT law.
The rise of consent or pay
For years the orthodox legal view was that charging a fee to users of internet services who refused to provide personal data was contrary to the GDPR, since it pressured them to consent to data processing. Then, in Meta, the Court of Justice took the opposite view and ruled that so-called ‘consent or pay’ models could be lawful, subject to some conditions. Social media firms have embraced this, and are now often insisting that users either provide data or pay for their services in a traditional, monetary, way. They want personal data in order to facilitate targeted advertising, from which they make most of their money.
The decision in Meta been the subject of much discussion, some institutional resistance, and much dismay. The precise nuances of the conditions which the Court requires for consent or pay models will have to be worked out in the coming months and years. However, the fundamental standpoint that an internet firm has the right to insist on payment for their services, and to give users the option of providing this in money or data, is actually a positive development for internet users. If properly managed, it can improve their rights, increase their chances of actually protecting their privacy, and tame the power of the giants. For consent or pay models elevate the status of the user from recipient of a free service to a paying consumer. That enhances their consumer law rights, which matters, as consumer law offers more developed policing of contractual terms and more emphasis on remedies than data protection law does.
VAT on data payments
Now it seems that consent or pay models may have another, more dramatic impact, in exposing online firms to massive VAT bills. Italy began a tax investigation into Meta in 2023, and concluded that it was liable for around 800 million euros in unpaid VAT on the value of the data it has received from users in Europe. The EU Commission’s VAT committee was asked for an opinion on this, but has not provided one. Some tax lawyers were sceptical of the Italian position. The problem was not that data would be a non-monetary payment – VAT law allows these to be valued and taxed. The problem was that to be taxable, the data provided must be consideration, provided in exchange for the service. VAT is only due on payments, not on gifts.
However, if the GDPR requires firms to provide their services equally to those who provide data and those who do not – as used to be argued by the European Data Protection Board – then that data is clearly not a condition for the services. In that case, it cannot be seen as consideration. That would make it not subject to VAT. Firms have traditionally claimed that their services were ‘free’ and Meta is resisting the Italian VAT claim on these grounds.
By contrast, if firms, following Meta, now embrace consent or pay models, that argument will become impossible. Not only is it beyond dispute that users who choose the ‘consent’ option are paying in data, but a guide to the taxable value of that data is conveniently provided by the alternative ‘pay’ option. The chances of firms escaping tax by claiming they provide free services become much smaller.
The death of a business model?
Social media companies can of course abandon consent or pay – it is permitted by Meta, but not required. They could insist that users are quite free to use their services without providing data or money. If users then do click on ‘accept’ the data would be arguably classified as a non-taxable gift, not a payment. However, one wonders whether the firms really want to do this, for in order for their argument to be plausible it will have to be actually possible for users to refuse to supply personal data; at the moment it is so complicated that while research suggests most users would like to, almost none successfully do.
So online firms are now between a rock and a hard place. One option is to make sure that any ‘contribution’ by users, in whatever form, is genuinely voluntary, which is not particularly attractive for a business. Admittedly, there are those who argue this should not be a problem; the major use of personal data is for targeted advertising, and there is some evidence that contextual, non-targeted, advertising can be just as effective. Maybe firms can make enough money out of selling access to their users, even without knowing much about them. However, the size of the online data economy, and the enormous hunger of online service providers to access personal data, suggests that it is extremely valuable to them. They themselves do not think that their business would be as successful without it.
The other option is to go with consent or pay, now that it is finally allowed. It has the great merit, from the perspective of the service providers, of ensuring that users provide value in return for their services. Which business would not welcome certainty that their customers will pay? However, that value, precisely because it is guaranteed, will be subject to VAT.
That all gives online service providers a hard choice; either they give up data, or they start paying tax. Either way, their business model is in for a shock.
Conclusion
For a long time internet service providers were able to obtain payment in data de facto, by making it unreasonably complicated to effectively refuse, but nevertheless insist to regulatory authorities that their services were ‘free’. That position is no longer viable. They either have to stop eating, or a big slice of data cake may disappear in tax.
Gareth Davies was a barrister in London before being a University Lecturer at the University of Groningen (2000-2007) and then moving to Vrije Universiteit Amsterdam (2007 to the present). In 2006 he was an Emile Noel Fellow at New York University Law School, and in 2014 a Fernand Braudel Senior Fellow at the EUI. He is the co-author, with Damian Chalmers, Giorgio Monti and Veerle Heyvaert of EU Law (5th edn, Cambridge University Press, 2024).