CMP
Are Cookie Walls Legal? What EU Regulators Have Said So Far
A clear guide to cookie walls: what GDPR and EU regulators say, recent rulings, and CMP best practices to avoid forced consent.
Are Cookie Walls Legal? What EU Regulators Have Said So Far
Cookie walls, the practice of denying access to a website unless users accept tracking, sit at the center of an ongoing GDPR debate.
Some publishers argue they need data to fund content. Regulators argue that users must have a real choice. So, what’s legal? And what’s not?
In this post, we break down:
- What cookie walls are and how they work
- What the GDPR says about conditional access
- What EU regulators and courts have said so far
- How your CMP setup should handle consent barriers
What Is a Cookie Wall?
A cookie wall is a mechanism that blocks access to a website or service until the user accepts all cookies, often including tracking or advertising cookies.
These are sometimes referred to as:
- Access-conditional consent
- Tracking paywalls
- Consent-or-leave banners
In effect, users are forced to accept cookies to view content which may violate GDPR’s definition of “freely given” consent.
What GDPR Says About Consent and Access
The General Data Protection Regulation (GDPR) requires consent to be:
- Freely given
- Informed
- Specific
- Unambiguous
According to Recital 42 and Article 7(4), consent is not valid if a user has no real choice — for example, if access is denied unless they agree to tracking.
Consent can’t be a condition for access to services unless that processing is strictly necessary.
In the case of advertising or analytics cookies, that threshold is rarely met.
Are There Any Exceptions?
Some publishers argue that users can either:
- Accept tracking cookies for free access, or
- Pay for access without tracking
This “cookie paywall” model was reviewed in a 2023 German court case (Axel Springer v. Datenschutzbehörde), where the court suggested it may be lawful if:
- Users get a genuine alternative (e.g., paid subscription), and
- The tracking is clearly explained and optional
However, no EU-wide consensus exists, and most regulators remain skeptical of this model.
Final Takeaway
Cookie walls remain a legal gray zone but the direction from EU regulators is clear: forced consent is not valid consent.
To stay safe:
- Avoid conditional access based on tracking
- Offer true alternatives to consent
- Use a CMP that supports transparent, user-friendly UX
Privacy and trust are long-term investments and so is compliance.
Sources
- EDPB Guidelines 05/2020 on Consent Under GDPR
- CNIL: Cookies and Other Trackers Guidelines (2020)
- Dutch DPA: Cookie Walls Are Not Allowed
- German Court Ruling on Cookie Paywalls
Was this helpful?Thanks for letting us know.
