Are Cookie Walls Legal? What EU Regulators Have Said So Far

Are Cookie Walls Legal? What EU Regulators Have Said So Far

Cookie walls, the practice of denying access to a website unless users accept tracking, sit at the center of an ongoing GDPR debate.

Some publishers argue they need data to fund content. Regulators argue that users must have a real choice. So, what’s legal? And what’s not?

In this post, we break down:

• What cookie walls are and how they work
• What the GDPR says about conditional access
• What EU regulators and courts have said so far
• How your CMP setup should handle consent barriers

---

What Is a Cookie Wall?

A cookie wall is a mechanism that blocks access to a website or service until the user accepts all cookies, often including tracking or advertising cookies.

These are sometimes referred to as:

• Access-conditional consent
• Tracking paywalls
• Consent-or-leave banners

In effect, users are forced to accept cookies to view content which may violate GDPR’s definition of “freely given” consent.

---

What GDPR Says About Consent and Access

The General Data Protection Regulation (GDPR) requires consent to be:

• Freely given
• Informed
• Specific
• Unambiguous

According to Recital 42 and Article 7(4), consent is not valid if a user has no real choice — for example, if access is denied unless they agree to tracking.

Consent can’t be a condition for access to services unless that processing is strictly necessary.

In the case of advertising or analytics cookies, that threshold is rarely met.

---

Are There Any Exceptions?

Some publishers argue that users can either:

• Accept tracking cookies for free access, or
• Pay for access without tracking

This “cookie paywall” model was reviewed in a 2023 German court case (Axel Springer v. Datenschutzbehörde), where the court suggested it may be lawful if:

• Users get a genuine alternative (e.g., paid subscription), and
• The tracking is clearly explained and optional

However, no EU-wide consensus exists, and most regulators remain skeptical of this model.

---

Final Takeaway

Cookie walls remain a legal gray zone but the direction from EU regulators is clear: forced consent is not valid consent.

To stay safe:

• Avoid conditional access based on tracking
• Offer true alternatives to consent
• Use a CMP that supports transparent, user-friendly UX

Privacy and trust are long-term investments and so is compliance.

---

Sources

• EDPB Guidelines 05/2020 on Consent Under GDPR
• CNIL: Cookies and Other Trackers Guidelines (2020)
• Dutch DPA: Cookie Walls Are Not Allowed
• German Court Ruling on Cookie Paywalls