The Consent Wall: When Blocking Access Until Consent Breaks the Law

A visitor arrives at your site and cannot see anything. A full-screen wall says accept cookies to continue, with no other way in. That is a consent wall, and in much of Europe it is not a design choice. It is a violation.

What the EDPB actually said

The EDPB's Guidelines 05/2020 on consent state the rule plainly: access to services must not be made conditional on consent to the storing of information, or gaining access to information already stored, on a user's device. A take-it-or-leave-it approach does not constitute a genuine choice. Consent must be freely given, and consent given to access a service that is otherwise blocked is not freely given, because the visitor has no real alternative.

The rule has teeth because national regulators enforce it differently, and the differences matter. Italy's authority prohibited cookie walls in its 2021 guidelines. Germany's guidance treats them as prohibited. France's CNIL has said cookie walls are not banned outright, but only when users have a genuine equivalent alternative to access the service. A wall that passes in France can draw enforcement in Italy, and the EDPB's position pushes the whole bloc toward the stricter reading.

The distinction between a wall and a banner is the distinction between blocking and asking. A banner asks for consent and lets the visitor continue either way. A wall blocks the content until the visitor consents. The banner respects the choice. The wall punishes the refusal. That is why the EDPB treats them differently, and why a site that replaces a banner with a wall has made its consent problem worse, not better.

What counts as a genuine alternative

A genuine alternative has to give the visitor real access without tracking and without a penalty. A metered model with a small number of free articles before a paywall preserves access for casual readers. Contextual advertising, which targets the page rather than the person, needs no tracking consent and keeps the content free. A subscription priced as a product, rather than a privacy toll, is a business model, not a consent mechanism.

What does not count is an alternative that strips the site to a useless shell, or a fee set high enough to push everyone toward consent. An alternative that is not really an alternative is the same wall with better copy, and regulators have said so. The test is whether a reasonable visitor would consider the alternative a real way to use the site, not whether the site can argue that one technically exists.

The same test applies to the reject path. A buried refuse link failed for the same reason: the refusal was technically possible and practically hidden. A wall with a reject button that is two clicks deep and greyed out is a wall, not a choice. The TCF purpose 1 storage question is the same issue at the vendor layer: consent that is claimed but not genuinely given.

The fix is structural, not cosmetic

If your site has a consent wall, the fix is to remove the block and replace it with a banner that lets the visitor continue without consenting, plus a genuine alternative for the content. That is a product decision, not a copy change. A wall with softer wording is still a wall.

And audit the rest of the consent flow while you are there. The stored consent string is only as good as the choice behind it: a string that says the visitor consented is worthless if the visitor was blocked until they did. Consent Mode modelling has the same dependency: the model is only valid if the consent it models was freely given. Fix the wall first, then the record means something.

Frequently asked questions

What is a consent wall?

A full-screen block that prevents access to a site until the visitor accepts cookies. Unlike a banner, which asks for consent and lets the visitor continue either way, a wall makes access conditional on consent, which the EDPB says is not freely given consent.

Are consent walls illegal everywhere in the EU?

Not everywhere, and not in every form. Italy prohibited them in 2021, Germany treats them as prohibited, and France allows them only with a genuine equivalent alternative. The EDPB's Guidelines 05/2020 say access must not be conditional on consent, and the direction of travel is toward stricter enforcement.

What makes an alternative to a consent wall genuine?

It has to give the visitor real access without tracking and without a penalty fee. A metered free tier, contextual advertising, or an optional subscription priced as a product all count. An alternative that strips the site to nothing, or a fee set to push everyone toward consent, does not.

Is a paywall the same as a consent wall?

No, if the paywall is a business model rather than a consent mechanism. A site that charges for content and offers a free tier is selling a product. A site that blocks content until the visitor accepts tracking, with payment as the only way out, is making access conditional on a choice the visitor did not freely make.