Consent or Pay: The Model the EDPB Ruled On

A news site offers you two doors: accept all tracking, or pay a monthly fee to read without it. The European Data Protection Board looked at that choice and said it is not a free choice, at least not the way large platforms run it.

What consent or pay actually is

Consent or pay is a cookie wall with a price tag. The visitor gets two options: consent to tracking, usually for advertising, or pay for access without tracking. It spread fast among large publishers and news organisations, because it looks like a compromise. The visitor keeps a choice, the publisher keeps revenue either way, and the banner stops being a wall and starts being a menu.

The problem is the choice itself. GDPR consent must be freely given, specific, informed, and unambiguous. The EDPB addressed consent or pay directly in Opinion 08/2024, and its position is that these models, as typically implemented by large online platforms, do not meet the standard for freely given consent. The reasoning follows from the EDPB's Guidelines 05/2020 on consent, which state that access to services must not be made conditional on consent to storing information on a user's device. A take-it-or-leave-it approach does not constitute a genuine choice.

The EDPB's concern is not abstract. Large platforms hold a position where refusing tracking has real costs for the user: losing access to a service they rely on, or paying a fee that functions as a penalty for privacy. The Board noted that platforms in this position should explore a third option, such as contextual advertising that does not rely on personal data. A genuine alternative has to exist for the consent to count as free.

Where the line falls in practice

The rules are not uniform across Europe, and that is part of the risk. CNIL in France has said cookie walls are not banned outright, but only when users have a genuine equivalent alternative to access the service. Italy's authority prohibited cookie walls in its 2021 guidelines. Germany's guidance treats them as prohibited. A consent-or-pay model that passes in one member state can draw enforcement in another, and the EDPB opinion pushes the whole bloc toward the stricter reading.

Smaller sites are in a different position, but not a safe one. The EDPB opinion focuses on large online platforms, and a small publisher with a pay option and a real free alternative has a stronger argument. The key word is real. An alternative that strips the site to a useless shell, or a fee set high enough to push everyone toward consent, is not an alternative. It is the same wall with better copy. Pre-ticked boxes failed for the same reason: the choice was not a choice, and the fines proved it.

What to do instead

If you run a site that needs consent revenue, build the third option first. Contextual advertising, which targets the page rather than the person, needs no tracking consent and keeps the content free. A metered model with a small number of free articles before the paywall preserves access for casual readers. A genuinely optional subscription, priced as a product rather than a privacy toll, is a business model, not a consent mechanism.

And audit the banner you already have. Reject button parity is the same fight at a smaller scale: the second layer is where consent goes to die, and a reject option buried two clicks deep is not a real refusal. The thousand-vendor first layer is the same problem at the other end: a choice nobody can meaningfully make. Consent or pay is the most visible version of a pattern this site has been documenting all year. The EDPB has now said, in writing, that the pattern fails. Build the alternative before a regulator builds the case for you.

Frequently asked questions

Is consent or pay illegal everywhere in the EU?

Not everywhere, and not in every form. The EDPB's Opinion 08/2024 says the model as typically run by large platforms does not meet the freely given standard. National regulators differ: France allows cookie walls only with a genuine equivalent alternative, Italy prohibited them in 2021, and Germany treats them as prohibited. The direction of travel is toward stricter enforcement.

What makes a consent-or-pay alternative genuine?

The alternative has to give the user real access without tracking and without a penalty fee. Contextual advertising, a metered free tier, or an optional subscription priced as a product all count. An alternative that strips the site to nothing, or a fee set to push everyone toward consent, does not.

Does the EDPB opinion apply to small publishers?

The opinion focuses on large online platforms, where the power imbalance is greatest. A small publisher has a stronger argument, but the underlying test is the same: was the consent freely given? A small site with a fair alternative is in a better position than a large platform without one, but neither is automatically safe.

What is the difference between a cookie wall and consent or pay?

A cookie wall blocks access entirely until the visitor accepts cookies. Consent or pay adds a second door: pay instead of accepting. Both make access conditional on a choice the visitor did not freely make, which is why the EDPB treats them under the same freely given test.