"Accept personalized ads, or pay €4.99/month." If you read news online in Europe, you have clicked through one of these banners this week. Publishers call it consent-or-pay. Critics call it pay-or-okay. Regulators call it... complicated.
The model exploded after Meta launched its ad-free subscription in late 2023, and it has been in legal contention ever since: an EDPB opinion, a €200 million fine under the Digital Markets Act, dedicated ICO guidance, a court loss for Austria's biggest liberal newspaper, and EDPB guidelines still being drafted as of mid-2026.
So if you run a content site and a subscription fallback looks tempting, the question is whether you can actually ship it. Here is where the law genuinely stands.
Are consent-or-pay banners legal?
Yes, consent-or-pay can be legal in the EU and UK — no regulator has banned the model outright — but only if the fee is appropriate, the paid option is genuinely equivalent, and consent stays granular. Binary "consent or pay" with nothing in between has already been found unlawful for Meta under the DMA, and regulators increasingly expect a third option: a free tier with non-tracking ads.
That one-paragraph answer hides a lot of jurisdiction-specific detail, so let's unpack it.
A quick scope note: this article is about models that offer a paid alternative to tracking. Banners that simply block access unless you consent — with no alternative at all — are a different (and much weaker) legal position, covered in our guide to whether cookie walls are legal.
Where "consent or pay" came from: the CJEU's "appropriate fee"
The entire model rests on one sentence from the Court of Justice of the EU. In Meta Platforms v Bundeskartellamt (Case C-252/21, July 2023), the court said users who refuse consent to personalized advertising must be offered an equivalent alternative — "if necessary for an appropriate fee."
That aside was the green light Meta and hundreds of European publishers were waiting for: charging for a tracking-free version is not automatically incompatible with freely given consent. What the CJEU did not do is define "appropriate." Every fight since has been about filling that gap.
The EDPB: a binary choice usually fails for large platforms
In Opinion 08/2024 (April 2024), the European Data Protection Board concluded that large online platforms will, in most cases, not obtain valid consent by offering only two options: consent to behavioural advertising, or pay.
The Board's reasoning maps onto the GDPR's "freely given" test — conditionality, detriment, power imbalance, and granularity. Its headline recommendation: controllers should consider offering a free "equivalent alternative" without behavioural advertising, for example a version funded by contextual ads. Pay-or-okay with no middle option, the EDPB says, makes the "choice" largely theoretical.
Two caveats for publishers: the opinion formally addresses large online platforms, not every news site — broader consent-or-pay guidelines for all controllers are on the EDPB's 2026–2027 work programme but, as of June 2026, not yet published. And Meta is challenging the opinion itself in the EU courts, so even the large-platform position is not fully settled.
There's data behind the EDPB's skepticism. A noyb-commissioned study (December 2025) found that roughly 2 in 10 users accept tracking when asked openly, about 9 in 10 "consent" when the only alternative is paying — and when a third "ads without tracking" option is added, about 7 in 10 pick it.
Supportive: a 90%+ consent rate proves the model funds journalism. Cynical: a 90%+ consent rate from people who refuse when asked politely is not consent, it's a toll booth.
The Meta saga: what the DMA decision actually decided
Meta's case is the reference point everyone cites, so it's worth getting the timeline right:
| Date | What happened |
|---|---|
| Nov 2023 | Meta launches binary "pay or consent" for Facebook/Instagram in the EU (€9.99/month web) |
| Apr 2024 | EDPB Opinion 08/2024: binary models usually fail for large platforms |
| Nov 2024 | Meta cuts the subscription ~40% (to €5.99/month web) and adds a free "less personalised ads" option |
| Apr 2025 | European Commission fines Meta €200 million under the DMA for the original binary model |
| Jan 2026 | Meta rolls out a revised less-personalised-ads experience (including unskippable ad breaks) |
| 2026 | Meta's appeal is pending before the EU General Court; consumer group BEUC argues the revised model still buries the third option |
The Commission's finding (Article 5(2) DMA) was that the binary model gave users no real choice of a service using less of their personal data: no equivalent free alternative, and a fee high enough to push users toward consent. This was a DMA decision against a designated gatekeeper — it doesn't directly bind your news site — but it is the clearest official statement yet of what "no meaningful choice" looks like, and the Commission has signalled that the less-personalised-ads third option is the direction it wants.
The UK: ICO says yes, if you can prove four things
The ICO took a more permissive path. Its consent-or-pay guidance (January 2025) states plainly that these models can comply with UK GDPR and PECR — if you can demonstrate consent is freely given against four factors:
| ICO factor | The question you must answer |
|---|---|
| Power imbalance | Can users realistically walk away, or are they locked in? |
| Appropriate fee | Is the price set so high that "pay" is not a real choice? |
| Equivalence | Is the core service the same whether users consent or pay? |
| Privacy by design | Are the options presented equally, without nudging? |
You must document this assessment in a DPIA — that's a hard requirement, not a suggestion. The ICO also flags that where there's a clear power imbalance, you should consider an extra option that requires neither consent nor payment, such as a contextual-ads tier. Sound familiar? UK and EU positions are converging on the same third option.
One moving part: the guidance carries an "under review" notice because of the Data (Use and Access) Act 2025. The ICO finalised its broader storage-and-access (cookies) guidance on 29 April 2026 and says updated online-advertising positions are coming. The four-factor framework is still the operative test today, but check for updates before you launch — we track this in whether you need to update your cookie banner in 2026.
France: CNIL accepts paywalls at a "reasonable price"
France is the most publisher-friendly major jurisdiction, thanks to a 2020 Conseil d'État ruling that blocked the CNIL from banning cookie walls outright. The CNIL's evaluation criteria (2022, still its operative position) say conditioning access on either accepting trackers or paying is permissible, subject to:
- a "reasonable" price, assessed case by case — the CNIL won't set a number, but the publisher must be able to justify it and is encouraged to publish the analysis;
- the wall covering only the purposes that actually fund the service (e.g., ad personalization — you can't bundle content-personalization consent into the gate);
- no consent-based trackers at all for users who choose the paid option;
- extra caution where the publisher has exclusive content or no real competitors.
Germany: the DSK blessed "PUR" models — with conditions
German publishers pioneered this model years before Meta ("PUR" subscriptions on Spiegel, Zeit and others). The German data protection conference (DSK) confirmed in a 2023 resolution that the model is permissible, provided the paid option is a genuinely equivalent service at a market-typical fee, consent meets all GDPR validity requirements, and — crucially — consent remains granular by purpose. Typical PUR subscriptions run a few euros a month, the informal European benchmark for "market-typical."
The publisher case that should worry you: derStandard
In August 2025, Austria's Federal Administrative Court confirmed that derStandard — the first newspaper in Europe to run pay-or-okay — violated the GDPR. Not because pay-or-okay is illegal as such, but because its banner offered only a global all-or-nothing choice: consent to everything, or pay. The court held users must be able to consent per purpose, even inside a consent-or-pay model.
The case is headed to Austria's Supreme Administrative Court and quite possibly the CJEU, which would finally give Europe a binding answer on pay-or-okay for publishers. Until then, the lesson stands: a paid alternative does not buy you out of granularity.
What publishers can actually do in mid-2026
If you're considering consent-or-pay, here's the defensible playbook:
- Offer three options, not two. Consent, pay, and a free reduced-tracking tier (contextual or "less personalised" ads). This is what the EDPB recommends, what the ICO points to under power imbalance, and what the Commission pushed Meta toward. It also matches what users actually choose.
- Price the paid tier like a market-typical subscription (think single-digit euros/pounds monthly, in line with German PUR norms), and write down your justification. CNIL and the ICO both expect you to be able to show your work.
- Keep consent granular. Per-purpose toggles must survive inside the model — this is exactly where derStandard lost.
- Make the paid tier genuinely equivalent. Same core content and features; only the ads model differs.
- Run and document a DPIA covering the ICO's four factors (it's mandatory in the UK and good evidence everywhere else).
- Honor the choice technically. Paying users get no consent-based trackers, full stop. Refusal and withdrawal must actually stop the tags.
- Geo-target the model. Consent-or-pay logic that's defensible in France or Germany may need a different configuration elsewhere — see what changed in cookie consent laws in 2026.
- Watch the EDPB guidelines. The all-controller consent-or-pay guidelines are still pending; build so you can adjust rather than rebuild.
Where CookieChimp fits
Consent-or-pay is a funding-model decision, but it lives or dies in consent mechanics: granular purpose toggles, region-aware banner variants, proof of what each user chose, and scripts that actually obey that choice. That's the part a modern CMP handles. CookieChimp gives you geo-targeted banners, per-purpose consent with full logging, automatic cookie scanning to verify nothing fires after refusal, and Google Consent Mode v2 support — the simple yet powerful foundation under whichever monetization model your lawyers sign off on.
FAQ
Is consent-or-pay banned in the EU?
No. The CJEU explicitly allowed an equivalent alternative "for an appropriate fee," and no EU-wide ban exists. But the EDPB says binary consent-or-pay usually fails for large platforms, the Commission fined Meta €200 million under the DMA for its binary version, and EDPB guidelines covering all companies are still pending. Legal, but narrow.
How much can I charge for the no-tracking option?
No regulator publishes a number. The CNIL requires a "reasonable" case-by-case price you can justify; the ICO tests whether the fee makes refusal unrealistic; German PUR subscriptions — the de facto benchmark — typically run a few euros per month. If your fee is priced to deter rather than to be bought, expect it to be treated as forced consent.
Do I need to offer a free third option with contextual ads?
It's not yet a hard legal requirement for ordinary publishers, but it's the clear direction of travel: the EDPB recommends it, the ICO expects it where there's a power imbalance, and the Commission pushed Meta into exactly that model. It's also what most users pick when offered.
Was Meta's pay-or-consent model found illegal?
The original binary model (November 2023–November 2024) was found non-compliant with the DMA in April 2025, drawing a €200 million fine. Meta has appealed to the EU General Court, and its revised model — cheaper subscription plus a free less-personalised-ads option — remains under scrutiny in 2026.
Can a consent-or-pay banner ask for one global "accept all"?
Risky. The Austrian DSB and Federal Administrative Court ruled derStandard's all-or-nothing version unlawful precisely because it lacked per-purpose consent. CNIL likewise limits the gate to purposes that fund the service. Keep granular toggles inside the consent path.
Does any of this apply in the US?
Not in this form. US state privacy laws work on opt-out rights and dark-pattern prohibitions rather than EU-style prior consent, so "consent or pay" isn't a recognized category there. See our guide to cookie banner requirements in US states.
References
- Court of Justice of the EU, "Judgment in Case C-252/21, Meta Platforms v Bundeskartellamt": eur-lex.europa.eu
- EDPB, "Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms": edpb.europa.eu
- EDPB, "'Consent or Pay' models should offer real choice": edpb.europa.eu
- European Commission, "Commission finds Apple and Meta in breach of the Digital Markets Act" (23 April 2025): ec.europa.eu
- Meta, "Facebook and Instagram to Offer Subscription for No Ads in Europe" (Nov 2024 update): about.fb.com
- ICO, "'Consent or pay' guidance — About this guidance": ico.org.uk
- ICO, "Guidance on the use of storage and access technologies" (finalised 29 April 2026): ico.org.uk
- CNIL, "Cookie walls : la CNIL publie des premiers critères d'évaluation": cnil.fr
- Datenschutzkonferenz (DSK), "Beschluss: Bewertung von Pur-Abo-Modellen auf Websites" (22 March 2023): datenschutzkonferenz-online.de
- noyb, "Court decides 'Pay or Okay' on DerStandard.at is illegal" (18 August 2025): noyb.eu
- noyb, "'Pay or Okay' study: Users prefer a tracking-free 'third option'" (4 December 2025): noyb.eu
- EDPB, "Work programme 2026-2027" (consent-or-pay guidelines in progress): edpb.europa.eu
If you're weighing a consent-or-pay model, get the consent plumbing right first — granular, geo-aware, and logged. Get started with CookieChimp and have the foundation ready before the lawyers finish arguing.