"In principle, data protection law does not prohibit business models that involve 'consent or pay,'" the ICO says on its website.
But it continues: "However, any organisation considering such a model must be careful to ensure that consent... has been freely given and is fully informed, as well as capable of being withdrawn without detriment."
At issue are several competing demands.
Regulators, like the ICO, want to make sure people remain, as far as is possible, in charge what happens to their personal data.
Websites, meanwhile, are wary of the shifting sands of online advertising - and fearful of losing revenue to more upstart parts of the online world, such as influencers.
"Fundamentally it comes down to an argument between a right to do business and a right to privacy," says Philippa Donn, a partner at DPN Associates, a consultancy which advises on data protection issues.