Cookie walls: may you block visitors who refuse cookies?

What is a cookie wall?

A cookie wall blocks the content of a website until the visitor clicks "Accept". There is no "Reject" option, or rejecting means you can't get in. The idea is to force consent for tracking or advertising cookies.

The problem is that consent only counts if it is freely given. That requirement comes from the GDPR, and in the EU and the UK it also applies to consent for cookies and similar technologies.

What the EU rules say

The European Data Protection Board (EDPB), in which all EU regulators work together, is clear in its Guidelines 05/2020 on consent: to be freely given, access to services and functionalities must not be made conditional on consent to storing or reading information on the visitor's device. Its example is a site that blocks all content except a request to accept cookies. According to the EDPB, the visitor has no genuine choice there, so the consent is not valid.

No EU law explicitly bans cookie walls, so national regulators apply this in different ways:

• The Dutch AP says websites must remain accessible when visitors refuse tracking cookies, and treats a cookie wall as not allowed.
• The French CNIL may not impose a general ban: in 2020 the Conseil d'État ruled that it could not do so in soft-law guidelines. The CNIL now assesses cookie walls case by case and expects a "real and fair" alternative.
• Other regulators have their own guidance. Check the position of the regulator in the country you are based in, and in the countries you target.

The rules may also change. The European Commission proposed changes to the cookie rules in its Digital Omnibus of November 2025, but as of October 2026 that proposal has not been adopted, so the current rules apply.

"Consent or pay"

Some publishers offer a choice: accept tracking for personalized ads, or pay for access without it. This is called "consent or pay" or "pay or OK".

• The EU Court of Justice said in 2023, in Meta Platforms v Bundeskartellamt, that users who refuse should be offered an equivalent alternative without that processing, if necessary for an appropriate fee.
• The EDPB's Opinion 08/2024 is about large online platforms only. It says that in most cases they cannot meet the requirements for valid consent if they only offer a choice between consenting to behavioral advertising and paying. The EDPB wants them to consider a free alternative without behavioral advertising.
• The CNIL does not ban a paid alternative in principle, but the price must be reasonable and the publisher must be able to justify it.

For an ordinary business website this is rarely relevant: you don't earn money from personalized ads, so there is nothing to "pay" for.

The UK view

In the UK, the cookie rule is in regulation 6 of PECR, and consent must meet the UK GDPR standard. The ICO's guidance on storage and access technologies, finalized in April 2026, says that whether a cookie wall gives valid consent depends on the model and how it is built, but that in most cases a "take it or leave it" approach does not comply: you must not bundle consent into the conditions of a service unless it is necessary for that service. Online advertising is not strictly necessary, because a service can technically be provided without ads.

For "consent or pay", the ICO published separate guidance in January 2025. In principle data protection law does not prohibit it, but you must assess four factors: power imbalance, equivalence of the service, an appropriate fee, and privacy by design. More in UK cookie law.

What to do instead

For almost every website the best option is simple:

1. Let visitors in either way. Show "Accept" and "Reject" side by side, equally visible, and keep the site usable after a rejection.
2. Block only what needs consent. Strictly necessary cookies may load; marketing and analytics tags wait for consent.
3. Use the exemptions where they really apply. In the UK, for example, some analytics and functionality cookies no longer need consent, as long as visitors can object.
4. Don't keep nagging. Respect a "Reject" for a reasonable time; the ICO suggests six months.
5. Explain clearly what you use and why, in your banner and your cookie policy.

Cookie Confirm works this way: the banner offers a free choice, blocks scripts until consent and can apply different rules per country. Which cookies need consent at all? See What are cookies?

Sources

• EDPB: Guidelines 05/2020 on consent under Regulation 2016/679
• EDPB: Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms
• EDPB: Letter of 19 November 2020 on cookie walls
• CJEU: Case C-252/21, Meta Platforms v Bundeskartellamt
• Autoriteit Persoonsgegevens: Websites must remain accessible when refusing tracking cookies
• CNIL: Cookie walls, first evaluation criteria
• ICO: How do the rules apply to online advertising?
• ICO: Consent or pay guidance
• ICO: How do we manage consent in practice?
• European Commission: Digital Package (Digital Omnibus)