Cookie Walls and Pay or Consent: When Charging for Privacy Is Allowed
The newest shape of the cookie banner offers two buttons and a dilemma: consent to tracking advertising, or pay a monthly fee for the same content without it. Supporters call it a fair exchange that funds journalism. Critics call it charging for a legal right. Regulators across Europe have landed in different places, and the argument is not settled.
Whatever your view, the model is spreading, so it pays to understand its mechanics. This guide explains how pay or consent works, the conditions regulators attach to it, and what separates a legitimate version from a consent wall wearing a price tag.
How the model works in practice
A visitor arrives and is offered tracked access for free or untracked access for a fee, usually a few pounds or euros a month, sometimes bundled with registration. The paid tier replaces behavioural advertising with contextual ads, house ads, or no ads, and is supposed to switch off the tracking stack entirely. Behind the scenes the publisher must run two genuinely different technical experiences and a consent record that reflects which path each visitor took. The complexity is the first hidden cost: if the paid tier still loads the same trackers and merely hides the ads, the model collapses from a business choice into a misrepresentation, and regulators have treated it exactly that way.
Why regulators argue about it
Privacy law says consent must be freely given, and the dispute is whether a price on refusal makes consent unfree. Several regulators have accepted the model in principle for media sites while attaching conditions: the fee should bear some relationship to the advertising value of a visitor, the paid option must be equivalent in content, and the model looks very different for dominant platforms or essential services, where refusal costs the visitor far more. Others remain sceptical, and guidance keeps evolving, sometimes mid implementation. Any publisher adopting the model needs advice for their specific market rather than a blog post's generalities, including this one. The direction of travel is towards stricter, not looser, conditions.
What a fair version looks like from the visitor's side
Fairness has a simple test: could a reasonable visitor decline tracking without feeling punished? That means the fee is modest and clearly explained, the paid tier is one click as easy as the tracked tier, and neither path uses shame based wording. Content should be equivalent; a paid tier quietly missing features is a penalty dressed as a product. The visitor should also be able to change their mind in both directions without contacting support. Finally, the truly free third option many regulators favour, refusing tracking and seeing contextual ads without paying, is worth offering where the economics allow, because it dissolves most of the fairness objection at a stroke.
What publishers should do before adopting it
Model the numbers honestly first: what a tracked visitor earns you, what a realistic minority will pay, and what the dual stack engineering costs to run properly. Then audit the paid experience with the same rigour as a banner test, verifying with network tools that trackers genuinely do not load for paying visitors. Prepare for scrutiny of your consent records, which now double as billing adjacent records. And plan the communications: audiences accept paid tiers from sites that explain the exchange plainly and early, and revolt against sites that spring a wall on loyal readers with a day's notice. The model can fund good publishing. Done lazily, it trades a decade of reader trust for a quarter of consent rates.
Related reading
These earlier guides cover connected questions in more depth: Consent for Podcast and Newsletter Tracking: What Creators Owe Listeners, Consent on Charity Donation Pages: Gift Aid, Data, and Donor Trust, and Consent and Secondhand Phones: The Previous Owner Data Still Sitting in Settings.
Frequently asked questions
Is pay or consent legal?
It depends on the jurisdiction and the details. Several European regulators accept it under conditions about pricing, equivalence, and market power, and the rules are still evolving. Publishers need market specific advice before adopting it.
How much should the paid option cost to be considered fair?
Regulators look for a relationship between the fee and the advertising value the visitor would otherwise generate. Fees set far above that value look like penalties for refusing, which undermines the consent.
Does the paid tier have to remove all cookies?
It must remove tracking and advertising cookies as promised. Strictly necessary cookies for security, load balancing, and remembering the paid login itself are generally accepted, and should be listed clearly.
Can a small site use pay or consent?
Technically yes, but the engineering and compliance overhead of running two genuinely different experiences is significant. Most small sites do better with a simple reject path and contextual advertising.