If targeted ads give you more revenue and you choose to use solely targeted ads because thats your business model GDPR does not forced you to provide a free service or a service that generate less revenue.
So no #2 doesn’t have to be as #1 this is confusing things with the single purpose clause in which case you can’t make X and Y being co dependent.
E.G. while I can perfectly refuse service if you do not accept ads I can’t refuse to sell you something for not wanting to join my mailing list.
Also not only that does nothing stopping you from having multiple bases for consent it’s actually the recommended approach.
"This is what we do do you agree: yes/no" is much easier than to develop a valid vital 1st and 3rd party interest for each case and most online services don't require a contract.
However the idea that somehow you have to provide services to people who do not consent is simply false.
That you can't do is tie completely unrelated interests to a single consent for example:
I have a website that shows you local events and allows you to sign up for them, my business model is to sell your contact details to promoters. If you do not consent there is no reason under the GDPR to compel me to provide you with a service that costs me money to run while you refuse to participate in my revenu stream.
What I can't do is say if I run a ticket website to refuse to sell you a ticket if you do not consent to me using the details you've put into in order to purchase them to be sold to promoters or in other words under the GDPR the information collected for the purpose of selling you a ticket cannot be used for another purpose selling your info to promoters.
It's also important to note that in some cases the "I agree" isn't actually used for consent it's just a UX quirk, you can still allow people to opt out even if you don't use consent as the lawful basis for example I can display you the following message:
"I collect the following information: XYZ, and issue the following tracking cookies: ZYX the lawful basis for this is the vital interest of my company and my business partners" I still technically need to give you a way to opt out, so the windows that says opt-out or agree isn't necessarily a consent window from a GDPR point of view.
And as previously mentioned I can deny a service to you if you opt-out because I can't monetize you in which case I can legally redirect you to a page that says you can't access by website until you agree to my terms, in this case again consent is not necessarily a lawful basis rather than you acknowledging the lawful basis i presented under my terms of service.
So will the counter position that sending reader info to countless third parties isn't actually necessary to monetize, as plenty segmentation value comes from the readers' selection of the site itself.
It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy.
In the meantime, here is a reasonably neutral but in depth overview for site owners interested in learning more to better navigate GDPR:
https://dma.org.uk/uploads/misc/5ae1fbf5c60fd-gdpr-for-marke...
I suggest you read the "legitimate Interests" part of the document you provided.
>It will be argued the marginal value of each additional exposure of the reader's private data does not outweigh the individual's right to privacy.
There is nothing in the GDPR that puts on legitimate interest over another including your so called right to privacy.
In fact there is one exception which thankfully limits legitimate interests of data controllers:
"processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child."
It remains to be seen in practice how much data controllers' interests can be overridden by "interests or fundamental rights and freedoms of the data subject".
https://www.marketingdive.com/news/google-will-support-non-t...
If Google can generate the same ad revenue of close enough to it without having you to force your users to agree or opt-out into oblivion in which case you lose the revenue stream from all users that opt-out.
It's also important to note that Google's non-targeted ads server two functions as they both allow you to display ads to users who did not consent to data collection as well as potentially protects you as an advertiser from ensuring that your ads are delivered in a GDPR compliant manner.
Under the broader interpretation of the GDPR you as an advertiser might be liable if you buy spaces for targeted ads that are displayed unlawfully and this is because GDPR essentially mandates that you must ensure the compliance of your partners.
"When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract."
And then Recital 43:
"Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance."
If:
1. You ask users for consent
2. The consent is not strictly necessary to provide the service
3. You deny the service to users who decline to give consent
Then the consent isn't freely given and therefore invalid.
> GDPR does not forced you to provide a free service or a service that generate less revenue.
True, but then consent isn't the right basis for processing of data. As you mentioned, business justification, or "legitimate interests" as GDPR puts it, is what you should be using.
Meaning i can't force you to sign up to my mailing list or refuse to sell you items on my store, the current interpretation of most DPA is that it doesn't apply to single purpose processing.
Also again as stated below people confuse the "I agree" button to a GDPR consent, the fact that there is ok/opt-out UI for GDPR does not mean that they are seeking consent as their lawful bases but they still need to inform the user and allow them to opt-out (even if opt-out means that they opt-out of the service).
Only about half the GDPR popups I've seen were actually worded solely for seeking consent even tho they had the agree/opt-out buttons below the text itself stated the legitimate interests of both them and their partners in why they need the data for most things with maybe a handful of purposes relying on consent alone.