It is an increasingly common message from websites: browse for free – if you allow us to track your data and target you with personalised ads – if you don’t, hand over some cash.

The model is known as “consent or pay” and, while it may be becoming increasingly common, questions remain over whether it is ethical or even legal.

The UK data regulator, the Information Commissioner’s Office (ICO) has launched a consultation on the practice – it will report its findings later this year.

“In principle, data protection law does not prohibit business models that involve ‘consent or pay,'” the ICO says on its website.

But it continues: “However, any organisation considering such a model must be careful to ensure that consent… has been freely given and is fully informed, as well as capable of being withdrawn without detriment.”

At issue are several competing demands.

Regulators, like the ICO, want to make sure people remain, as far as is possible, in charge what happens to their personal data.

Websites, meanwhile, are wary of the shifting sands of online advertising – and fearful of losing revenue to more upstart parts of the online world, such as influencers.

“Fundamentally it comes down to an argument between a right to do business and a right to privacy,” says Philippa Donn, a partner at DPN Associates, a consultancy which advises on data protection issues.

There’s a common way to understand internet business models: “If you’re getting it for free, you are the product.”

What that means in practice is websites give away their content away for free and in return you feed them with your personal data.

They then sell that information so you can be targeted with ads more personal to you – and more lucrative for them.

But, since 2018, there has been a threat to that model: websites in the UK have had to ask for explicit consent to use cookies and similar tracking technologies.

Everyone has become familiar with the pop-up when you visit a site, asking you to “accept all” or reject nonessential cookies.

The problem for websites is that if you reject tracking they gather less information, which means advertisers pay them less because they as less confident about how well directed their ads are.

Which is where “consent or pay” comes in – it is an attempt by websites to make up for the money they lose if you say no to your data being collected and sold.

One of the industries this particularly affects is the print media, which is largely funded by advertising and paywalls online.

But online advertisers have taken their spending elsewhere – on social media sites, influencers and brand deals – leaving a black hole in newspaper budgets.

Newspapers such as MailOnline, The Sun, The Independent and The Times have all recently brought in “consent or pay” models.

“It’s basically saying, ‘We’re giving people a choice. They can either pay and get ad-free access to our articles, or they can be tracked, or they can walk away and not read it,'” Philippa Donn says.

This question being considered by the ICO and others is – is that a fair choice?

The idea of freely-given consent has to meet a “very high bar,” says Eva Lu, associate at law firm Stephenson Harwood.

For Ms Lu, it comes down to whether the user has “a genuinely free choice to how their personal data should be used by the organisation.”

This means that whether or not the model is allowed may come down to a case-by-case basis.

The amount users have to pay for privacy may be taken into account.

Another factor considered will be the size of the company and if there is an alternative option for users.

“If you can’t read a certain article, you might just choose not to and you can go read about it somewhere else,” says Ms Lu.

But for other industries, such as film and TV streaming, “it could be a lot harder to justify,” she adds.

“From a user’s perspective, if I want to watch a film or a TV show and it’s only available on that streaming service or platform, then that the alternative may not be there elsewhere.”

The question has been tested on social media in the EU, where Meta put a “pay or consent” policy on Instagram and Facebook.

Under this model, Facebook and Instagram still track your behaviour on their apps in order to feed the recommendation alogrithm.

But that data is not used to target ads at you.

In general in the EU, the tech giants such as Meta are held to higher standards than smaller companies when it comes to regulation.

In July, the European Commission informed Meta that preliminary findings suggest its “pay or consent” model is against EU law.

Meta now has the right to review the evidence gathered by the EU and mount a defence.

Meta maintains it is acting within the law and “subscriptions as an alternative to advertising are a well-established business model across many industries”.

The company is currently in discussions with the ICO, the UK data regulator, about bringing the model to the UK in the future.

A company spokesperson says they are “engaging constructively” and will share more information in the future. No decisions have been made yet.