Are "Consent or Pay" Cookie Walls Legal?
What "consent or pay" means, where EU regulators have landed on it, and the separate legal track that gets confused with it.
6 min read
"Consent or pay," sometimes called "pay or okay," offers visitors a choice: accept tracking, or pay for a version without it. As of September 2026, EU regulators have said this model generally does not produce valid consent for large online platforms, because a paid option is not the same as a free one. The situation is still developing, and it runs on two separate legal tracks that are easy to confuse.
What "Consent or Pay" Means
Instead of a normal accept-or-reject banner, a consent-or-pay wall makes the free version conditional on accepting behavioral advertising. Refusing tracking is possible only by paying a subscription. Publishers adopted it to keep ad revenue while offering a nominal alternative; regulators questioned whether a choice with a price tag on the "no" is freely given at all.
The EDPB's Position
In April 2024, the European Data Protection Board (EDPB) issued Opinion 08/2024 on these models. Its core finding: large online platforms generally cannot obtain valid consent through a binary "consent or pay" choice under GDPR, because consent must be freely given, and a paid alternative does not make refusal free. The EDPB pointed to a genuine, usually free, equivalent option without behavioral tracking as what real choice looks like. As of September 2026 this remains the operative guidance, not overturned.
The Separate DMA Track
Here is the confusion to avoid. In April 2025, the European Commission fined Meta 200 million euros over its subscription-or-consent model. That fine was issued under the Digital Markets Act (DMA), a competition rule that applies to designated "gatekeeper" platforms, not under GDPR, and not by the EDPB. The two are different bodies enforcing different laws against the same underlying design. Coverage that treats the Meta fine as a GDPR consent ruling gets the law wrong. In response to the pressure, Meta added a third, free "less-personalized ads" option, which regulators described as a step in the right direction rather than a resolution.
What It Means for You
Most companies are neither "large online platforms" in the EDPB's sense nor DMA gatekeepers, so the strictest findings may not apply directly. But the direction of travel is clear: the safer a consent flow is, the more it looks like a genuine, cost-free choice to refuse tracking. Building your banner around a real reject option, rather than a wall with a price behind it, keeps you clear of the question entirely.
How Concord Fits
Concord's consent banner is built around a genuine, equally easy choice to accept or refuse, the posture regulators have consistently favored, so you are not betting your compliance on a contested model. Reject is as available as accept, the choice is recorded, and the rest of your program, from privacy requests to data mapping, runs on the same platform, so the consent you collect holds up if a regulator asks how it was obtained.