Does Ad-Free Mean Less Data Collection? An Empirical Study of Platform Data Practices and User Expectations

Online platforms increasingly offer “paid” ad-free subscriptions as an alternative to the traditional “free” ad-based model. The transition to ad-free models ostensibly removes advertising as a key justification for data processing under the GDPR. So, normatively, platforms should collect less user data. However, platforms may justify continued data collection as a means to provide an improved, personalized experience. This tension between privacy principles and platform incentives raises a critical underexplored question: do data collection practices vary between ad-free and ad-based subscription models? In this paper, we shed light on this important privacy issue by investigating the alignment between platform data collection practices and related user expectations. With respect to data collection process, our analyses of data exports from three major online platforms - Instagram, Facebook, and X - reveal that these platforms continue to retain or collect some ad-related data, even in ad-free subscriptions. With respect to user expectations, our survey among 255 participants on Prolific reveals that 69% of the participants normatively expect data collection to be reduced, indicating their expectation of improved digital privacy in an ad-free model. However, when asked what they think actually happens, 63% of these participants believed that platforms would still collect about the same amount of data, highlighting skepticism about platform practices. Our findings not only indicate a significant disconnect between data practices and normative user expectations, but also raise serious questions about platform compliance with core GDPR principles, such as purpose limitation, data minimization, and transparency.

💡 Research Summary

The paper investigates whether “ad‑free” subscription models lead to reduced personal data collection compared with traditional ad‑supported services. The authors focus on three major platforms—Instagram, Facebook, and X (formerly Twitter)—that offer both ad‑based and ad‑free options. Using the GDPR Right of Access (Article 15), they obtained Data Download Packages (DDPs) at three points: before switching to an ad‑free subscription, three weeks into the subscription, and after returning to the ad‑based model. Each DDP contains hundreds of files; the authors classified these files into three categories: ad‑only, non‑ad, and mixed (containing both advertising‑related and service‑functionality data). Their analysis shows that while some ad‑related files disappear after the switch, all three platforms continue to retain or collect a non‑trivial amount of advertising‑related data even in the ad‑free mode. For example, Instagram retained seven ad‑only files, Facebook twelve, and X six, and mixed files still linked personal data to advertising purposes, raising concerns about compliance with GDPR’s purpose‑limitation and data‑minimization principles.

In parallel, the authors conducted an online survey with 255 Prolific participants to gauge user expectations. They distinguished between normative expectations (what users think should happen) and descriptive expectations (what users think actually happens). A clear gap emerged: 69 % of respondents believe platforms ought to collect less data under an ad‑free subscription, yet only 17 % expect that this reduction will actually occur, and 63 % think data collection will stay roughly the same. Moreover, 34 % indicated they would be deterred from choosing an ad‑free plan if data collection remained unchanged, suggesting that privacy expectations influence subscription decisions.

The legal discussion highlights GDPR Articles 5 and 6, emphasizing that in an ad‑free context the legitimate‑interest basis for data processing must be reassessed because the primary advertising purpose is removed. Continuing to process advertising‑related data without a clear, necessary link to service personalization may fail the necessity and proportionality tests required for lawful processing. The paper also notes that transparency obligations (Article 12) and the effectiveness of the Right of Access are limited if users cannot easily interpret the dense DDP contents.

Overall, the study reveals a misalignment among three elements: (1) platform data‑handling practices, which still retain advertising data despite the subscription model change; (2) user expectations, which anticipate stronger privacy protections in ad‑free plans; and (3) GDPR requirements, which may be violated by insufficient purpose limitation and data minimization. The authors call for clearer regulatory guidance on how “legitimate interest” should be applied to ad‑free services, more granular transparency for users about what data is retained for advertising versus personalization, and coordinated efforts among legal, engineering, and product teams to ensure compliance. They suggest future work should expand to more platforms, longer subscription periods, and deeper analysis of how ad‑free models affect the broader data ecosystem.