“Consent or Pay” in 2026: What’s Actually Settled and What Isn’t

What “consent or pay” actually means

Also called “pay or okay”: the visitor gets a binary choice — accept behavioural advertising, or pay a subscription for a tracking-free version. Meta rolled it out in the EU in late 2023, and a wave of European publishers followed. The model exists because GDPR consent must be freely given, and publishers argued that paying is a genuine alternative that makes the choice free.

Where the law actually stands

The reference document is EDPB Opinion 08/2024, adopted in April 2024 after a referral from the Dutch, Norwegian and Hamburg supervisory authorities. Its core finding:

• In most cases, large online platforms will not obtain valid consent by offering only the binary choice between consenting to behavioural advertising and paying a fee.
• Those platforms should also offer an “equivalent alternative” — the free service, without behavioural advertising. Less personalised ads (contextual, or based on limited data) are floated as the way to fund it.
• The assessment is case-by-case, weighing the fee, the power imbalance, and whether refusing carries a detriment.

Three qualifiers matter more than the headline. It is an opinion under Article 64 — it binds the supervisory authorities’ approach, not merchants directly. It is scoped to large online platforms, not every publisher with a paywall. And “in most cases” is not “never”.

What is still pending

The EDPB has been working on full Guidelines on consent or pay with a deliberately broader scope than the 2024 opinion — reaching beyond large platforms. It ran a stakeholder event in November 2024 and the work continues under the EDPB Work Programme 2026-2027, adopted 11 February 2026. As of this writing the guidelines have not been published, so there is no consultation draft to design against.

Practically: anyone telling you the rules for a mid-sized publisher are settled is guessing. The honest position is that Opinion 08/2024 signals the direction of travel, and the guidelines that will actually cover smaller operators are still being written.

What to do while it’s unsettled

• Don’t assume you’re in scope of the opinion — or that you’re safely out. If you’re not a very large platform, the binding analysis is your national DPA’s, and several have taken positions of their own.
• Price is evidence. A fee set high enough that nobody would rationally choose it is the fastest way to make consent look coerced.
• Get the mechanics right regardless. Whatever the model, consent still has to be as easy to refuse as to give, and nothing non-essential may fire before the choice is made. That part is not pending — it is settled law, and it is what actually generates complaints today.
• Watch the US separately. Consent-or-pay is a European debate; US exposure runs through state privacy laws and wiretapping claims instead. See US state privacy laws and cookies and our lawsuit-target breakdown.

The failure that isn’t about the paywall

In practice, most consent-or-pay implementations we see fail for a mundane reason that has nothing to do with the pricing debate: the analytics and ad stack fires while the wall is still on screen. If trackers run before the visitor has chosen either branch, the legal argument about whether the fee was fair never gets reached — consent was invalid on timing alone.

Run a free audit on the page that hosts your wall: CookieInspector loads it as a first-time visitor and timestamps every cookie and tracker against the moment of choice, exportable as a PDF for the compliance file. Whatever the EDPB concludes about the fee, this is the part you can fix today.