# Consent or pay: are cookie paywalls legal under GDPR?

> When a 'consent or pay' cookie wall can be lawful in the EU and UK, what the CJEU, EDPB, CNIL and ICO have said, and how to design one that holds up.

Source: https://www.cookiesh.eu/blog/consent-or-pay  
Published: 2026-10-29

## Key takeaways

- A 'consent or pay' model asks visitors to either accept tracking for advertising or pay for access without it.
- EU law does not ban consent or pay outright, but consent is only valid if refusing it carries no unfair detriment, so the paid option must be a genuine, reasonably priced alternative.
- The EDPB said in 2024 that large online platforms will in most cases not obtain valid consent with a binary consent-or-pay choice, and should also offer a free option without behavioral advertising.
- The European Commission fined Meta €200 million in 2025 under the Digital Markets Act over its consent-or-pay model.
- Smaller publishers are assessed case by case, on factors such as market power, price, equivalence of the paid service and granularity of consent.

A "consent or pay" model, sometimes called a cookie paywall, gives visitors two ways in: accept tracking for personalized advertising, or pay for access without it. It is not banned outright in the EU or UK, but it is only lawful if refusing consent carries no unfair detriment. In practice that means a fair price, a genuinely equivalent paid option and, for the largest platforms, usually a free option without behavioral ads as well.

## What is a consent or pay model?

A consent or pay model replaces the usual "Accept" and "Reject" buttons with a choice between accepting tracking and paying. Visitors who accept get the free, ad-funded site. Visitors who pay get access without personalized advertising, and usually without the tracking that supports it.

It differs from a plain cookie wall, where refusing consent means losing access entirely. With consent or pay, refusal has a price instead of a dead end. Publishers adopted the model as consent rates fell and ad revenue from non-consenting users dropped, and large platforms followed.

## What does EU law say about it?

The starting point is GDPR's definition of consent, which must be freely given. Under Article 7(4), when assessing whether consent is free, regulators look at whether access to a service is made conditional on consent to processing that is not necessary for it. A model that punishes refusal fails that test. For the full list of conditions, see the [valid consent checklist](/blog/valid-consent-checklist).

In 2023, the Court of Justice of the EU addressed the question indirectly in *Meta Platforms v Bundeskartellamt* (C-252/21). It said users who refuse particular data processing that is not necessary for the contract should be offered, if necessary for an appropriate fee, an equivalent alternative without that processing. The phrase "for an appropriate fee" became the legal hook for consent or pay.

The European Data Protection Board then narrowed it. Its Opinion 08/2024, adopted in April 2024, says that large online platforms will in most cases not be able to obtain valid consent if they offer users only a binary choice between consenting and paying. It encourages them to also offer a free alternative without behavioral advertising, such as a version with contextual or less personalized ads. The opinion covers large online platforms specifically, so it is not a direct ruling on smaller sites, but national regulators read it closely.

## How have regulators applied it?

Regulators have taken a case-by-case approach with broadly similar tests. This table summarizes the main positions.

| Authority | Position | Key factors |
| --- | --- | --- |
| CJEU (2023) | An equivalent alternative may be offered for an appropriate fee | Equivalence, appropriate fee |
| EDPB (2024) | Binary consent or pay is usually not enough for large platforms | Power imbalance, detriment, a free alternative without behavioral ads |
| CNIL, France (2022) | Cookie walls are assessed case by case | A real, fair alternative and a reasonable price |
| ICO, UK (2025) | Consent or pay can be lawful if it meets the conditions | Power imbalance, equivalence, appropriate fee, privacy by design |
| European Commission (2025) | Meta's model breached the Digital Markets Act | A less personalized but equivalent alternative for users who refuse |

The Commission's decision against Meta came under the Digital Markets Act, which applies only to designated gatekeepers, not GDPR. It still shows how regulators think: in April 2025 the Commission fined Meta €200 million for offering EU users of Facebook and Instagram only a choice between consenting to personalized ads and paying a subscription.

## Can a smaller publisher use consent or pay?

Often, yes, if the design is fair. The concerns about power imbalance that weigh on large platforms are weaker for a news site or niche publisher whose users can easily go elsewhere. Regulators will still look at the details, so check these points.

1. **The price is reasonable.** Set it with reference to the advertising revenue a typical user generates and to prices for similar services, not as a deterrent. Write down how you reached the figure.
2. **The paid option is equivalent.** Subscribers should get the same content and core features as consenting users, without the tracking.
3. **The paid option is actually tracking-free.** Check that advertising and tracking tags really stop for subscribers. A paid tier that still loads ad pixels is worse than no paid tier.
4. **Consent stays granular.** Accepting the free option should not bundle every purpose together. Users should still be able to choose among non-essential purposes where they reasonably can.
5. **The choice is honest.** Present both options neutrally, without the [dark patterns](/blog/cookie-banner-dark-patterns) regulators look for, such as hiding the paid option or making it look like the wrong answer.
6. **Withdrawal still works.** Users who accepted must be able to withdraw consent as easily as they gave it. See [how to let visitors withdraw cookie consent](/blog/withdraw-cookie-consent).
7. **Children are treated differently.** If children are likely to use your service, take extra care; the ICO's guidance treats this as a higher-risk scenario.

Record your reasoning on each point. If a regulator asks, you will need to show why consent obtained through the wall was freely given.

## What does this mean for the banner itself?

A consent or pay banner still has to meet every other consent requirement: clear information, an affirmative action, no pre-ticked boxes and a way to change your mind later. It just replaces "Reject" with "Subscribe" or "Log in" as the alternative to accepting.

From an engineering point of view, three states matter: consenting visitors, subscribers and undecided visitors. Your consent layer needs to know which one applies on each page view so that tags fire only for consenting visitors, and subscribers are recognized before any advertising script loads.

## Bottom line

Consent or pay can be lawful in the EU and UK, but only when refusing tracking is a fair choice rather than a penalty. Keep the price reasonable, make the paid option genuinely equivalent and tracking-free, keep consent granular and document why your model works. Large platforms face a higher bar and should expect to offer a free option without behavioral ads as well. Tools like Cookiesh can enforce the technical side, blocking advertising tags until consent and keeping a record of each visitor's choice.

*This article is general information, not legal advice. For decisions about your specific situation, consult a qualified privacy professional.*

## FAQ

### Is a cookie wall that blocks content until users accept illegal?

A pure 'take it or leave it' wall, where refusing means losing access with no alternative, is very hard to justify in the EU and UK because consent would not be freely given. Offering a fair alternative, such as a paid tracking-free option, changes the analysis but does not make the model automatically lawful.

### How much can I charge for the paid option?

No regulator sets a figure. The CNIL and the ICO both say the price must be reasonable, so that it does not pressure people into consenting. Compare it with the advertising revenue you would lose and with prices for similar services.

### Do paying subscribers need to see a cookie banner?

Not for advertising tracking, because that is what they paid to avoid. You still need consent for any other non-essential processing you want to do for them, such as optional analytics, so plan a smaller preferences panel for subscribers.

### Does consent or pay apply outside the EU and UK?

The debate is mainly European, because EU and UK law require consent for advertising cookies. In opt-out regimes such as California, the bigger question is whether charging for an opt-out conflicts with rules against discriminating against consumers who exercise their rights.

## Sources

- [Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms, EDPB](https://www.edpb.europa.eu/our-work-tools/our-documents/opinion-board-art-64/opinion-082024-valid-consent-context-consent-or_en)
- [Case C-252/21, Meta Platforms v Bundeskartellamt, CJEU](https://curia.europa.eu/juris/liste.jsf?num=C-252/21)
- [Cookie walls: la CNIL publie des premiers critères d'évaluation, CNIL](https://www.cnil.fr/fr/cookies-et-autres-traceurs/regles/cookie-walls/la-cnil-publie-des-premiers-criteres-devaluation)
- [Consent or pay, Information Commissioner's Office](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/online-tracking/consent-or-pay/)
- [Commission finds Apple and Meta in breach of the Digital Markets Act, European Commission](https://ec.europa.eu/commission/presscorner/detail/en/ip_25_1085)