Many people are familiar with being asked to accept cookies or agree to the collection of their personal information when using online platforms.

But what happens when the choice is to pay for privacy or consent to more extensive data collection? Should we have to pay to protect our privacy or surrender our personal information to use these platforms?

These are among the questions raised by Stellenbosch University legal scholar Zinhle Novazi in research highlighted in a university press release issued this week.

A lecturer in the Department of Mercantile Law, she looked at the pay-or-consent model, which forces users to either consent to personal data processing for behavioural advertising or pay a subscription fee to use platforms without data tracking.

In a study published in the Stellenbosch Law Review in December 2025, she examined Meta’s model for Facebook and Instagram, introduced in Europe in 2023. Her research considers whether South African law would be equipped to regulate a similar model if introduced locally.

Legal framework remains fragmented

“The legality of the pay-or-consent model depends on whether users are given a genuine and fair choice, and whether the model complies with data protection, consumer protection, competition and contract law,” says Novazi.

She explains that consent is only meaningful when a person can refuse unnecessary data processing without suffering exclusion, disproportionate financial consequences or losing essential digital connections.

“A user may be presented with two buttons, but that does not mean the alternatives are practically accessible or equivalent,” she says.

Many users have spent years building networks, storing photographs, developing business pages and maintaining relationships on platforms like Facebook and Instagram. Refusing consent may mean losing access to an established community or digital identity.

Economic pressure forces consent

Novazi says paid alternatives may also be unaffordable in a country with high economic inequality.

“Users may technically consent, but do so under significant economic and structural pressure,” she adds.

According to Novazi, South African law remains fragmented. Although mechanisms exist within the Protection of Personal Information Act 4 of 2013 (Popia), the Consumer Protection Act 68 of 2008 (CPA) and competition law, clear rules and co-ordinated regulatory enforcement are lacking.

“This places too much responsibility on individual consumers to challenge powerful platforms after harm has occurred,” she says.

Courts cautious on contract law

Novazi adds that common law contract protections are also limited, as courts generally require proof that someone was unlawfully pressured into an agreement and remain cautious about applying public policy or constitutional rights to invalidate unfair terms.

She points to the European Union (EU) for guidance, where the Court of Justice of the EU ruled in Meta Platforms v Bundeskartellamt that personalisation does not make extensive data collection contractually necessary unless it is objectively indispensable.

European regulators also emphasised that large platforms must offer a free, less intrusive alternative that provides the same service without relying on behavioural advertising.

Strengthening local privacy laws

Novazi highlights the importance of strengthening Popia with clear, binding regulatory guidance and ensuring the CPA applies when consumers exchange personal information for services.

“Platforms should not be allowed to combine behavioural advertising, sharing personal information, service improvements and cross-platform tracking into a single request,” she says.

She calls for closer collaboration between the Information Regulator, Competition Commission and consumer protection authorities to address digital inequality and prevent privacy from becoming a luxury.

Breaking news at your fingertips… Follow Caxton Network News on Facebook and join our WhatsApp channel.

Nuus wat saakmaak. Volg Caxton Netwerk-nuus op Facebook en sluit aan by ons WhatsApp-kanaal.