What “Consent or Pay” is and why it is under pressure
The model emerged as classic tracking cookies came under pressure and ad-funded providers looked for a new legal basis. The idea: those who refuse data-driven advertising should pay instead. Legally, the pattern leans on the notion that a paid alternative makes consent “freely given” because the user has a choice. In case C-252/21, the Court of Justice of the EU suggested that users could, where appropriate, be offered a tracking-free variant for an “appropriate fee” (CJEU C-252/21). Many providers turned that half-sentence into a business model.
The catch: “may, for an appropriate fee” often became “only for a fee or full consent.” That undermines the freely-given requirement. Anyone forced to either accept comprehensive tracking or pay has no genuine third option — which is exactly where regulatory criticism bites. The pattern is no longer limited to very large platforms: publishers, comparison portals and increasingly smaller sites are experimenting with it. Anyone who knows the basics of GDPR-compliant website analytics quickly sees how the burden of proof can turn into a boomerang.
The EDPB stresses that personal data must not be treated as a tradeable commodity (EDPB). A model that ties the only free use to disclosing data for behavioural advertising imports exactly that logic onto the website — and typically undermines the freely-given nature of consent under Article 4(11) GDPR (Art. 4(11) GDPR).
The EDPB line: Opinion 08/2024 and the 2026 guidelines
On 17 April 2024 the EDPB adopted Opinion 08/2024 on valid consent in consent-or-pay models used by large online platforms (EDPB). Its core message: in most cases valid consent is not possible if users face only the binary choice between consenting to behavioural advertising and paying a fee (EDPB). The Board therefore regularly calls for a genuine, equivalent and usually free third option without behaviour-based advertising (EDPB).
This third option need not mean dropping advertising altogether. The EDPB cites advertising that processes less or no personal data — for example general, context-based advertising or advertising based on interest areas the user selects (EDPB). If a fee is charged anyway, it should be low enough not to undermine the freely-given nature of consent; a purely paid escape should not be the default path (EDPB).
Opinion 08/2024 expressly concerned only very large platforms. But in its work programme 2026-2027, adopted on 11 February 2026, the EDPB announced guidelines with a broader scope (EDPB Work Programme 2026-2027). The direction is set: what applies to large platforms will in time be measured against smaller offerings. Operators who set up banner-free, tracking-free measurement early spare themselves the retrofit once the broader guidelines take hold.
| EDPB requirement | What it means for the cookie banner |
|---|---|
| A genuine third option | Beyond “consent” and “pay”, a tracking-free, usually free path |
| No data disclosure as the price | Advertising without a behavioural profile (context- or interest-based) must be possible |
| An appropriate, low fee | A price must not effectively coerce consent |
| Freely given, informed, unambiguous | Consent under Article 4(11) GDPR without detriment or pressure |
| Burden of proof on the operator | Under Article 7(1) GDPR the operator must evidence validity |
Why the binary pattern usually is not valid consent
Consent is only valid under Article 4(11) GDPR if it is freely given, specific, informed and unambiguous (Art. 4(11) GDPR). The binary pattern typically fails on the freely-given test: someone who can only choose between comprehensive tracking and a payment does not truly give consent freely but under economic pressure. The EDPB sees no valid basis here in most cases (EDPB).
- Freely given: there is no reasonable alternative without detriment — for many users, paying is not a real choice.
- Specific: blanket consent to broadly framed behavioural advertising is rarely “for the specific case”.
- Informed: users can hardly grasp the chain of data recipients, purposes and advertising partners.
- Unambiguous: dark patterns that nudge toward “Accept” dilute the clear, active action.
There is also a German particularity: storing or reading information on the device — that is, setting and reading cookies — generally requires consent under Section 25 TDDDG, regardless of whether personal data is involved (Section 25 TDDDG). A consent-or-pay banner does not solve this; it merely shifts it into a questionable payment option. How to obtain consent cleanly when you actually need it is covered in the piece on implementing cookie consent correctly.
The burden of proof lies with the operator
The often-overlooked point: under Article 7(1) GDPR the controller must be able to demonstrate that valid consent exists (Art. 7 GDPR). It is not for the supervisory authority to prove invalidity — the operator must document validity. With a binary pattern that is hard: if the very structure calls the freely-given nature into question, even a perfectly logged consent record helps little.
A consent-or-pay banner shifts effort and liability onto the operator: they must justify prices, keep alternatives available, log consents and, in a dispute, prove validity. Each of these duties is an attack surface — for complaints, warnings and supervisory proceedings. Designing data collection so that no consent is needed in the first place lifts that burden of proof off your shoulders from the start.
That authorities and civil-society groups look closely is not theory. In August 2021 the privacy organisation noyb filed a first wave of 422 formal GDPR complaints against misleading cookie banners (noyb); after warnings to more than 500 companies, 42 percent of the previously criticised sites added a reject option within 30 days (noyb). In October 2024 a European supervisory authority upheld such a complaint and required “Reject” and “Accept” to be shown with equal prominence (noyb). The trend clearly points toward genuine free choice.
What this means for SMEs and agencies
For small and mid-sized businesses the situation is uncomfortable: building an elaborate consent-or-pay model rarely pays off — and is legally risky. A classic cookie banner without a paid option, in turn, costs measurement reach because a large share of visitors do not consent. Three paths are on the table, and only one removes the dilemma entirely:
| Path | Legal risk | Data quality | Effort |
|---|---|---|---|
| Consent or pay (track or pay) | high — freely-given questionable, burden on operator | high on consent, but contestable | high (prices, alternatives, evidence) |
| Cookie banner without a paid option | medium — depends on clean implementation | low — large consent gap | medium (banner, consent management) |
| Cookie-free first-party measurement | low — no consent needed | high — nearly all visitors captured | low — one snippet, no banner |
The third path sounds too simple, yet it is technically and legally sound. It requires that measurement works without accessing device storage and builds no profiles across pages. That is exactly what sets a cookie-free analytics solution apart from the large ad-funded statistics services that rely on cookies and cross-site profiles.
The way out: no consent dilemma at all
The consent duty of Section 25 TDDDG kicks in as soon as information is stored on or read from the device (Section 25 TDDDG). Avoid both, and the trigger for consent disappears — and with it the entire consent-or-pay edifice. That is the lever: measurement that sets no cookie, writes no value to local storage and builds no cross-device profile needs no consent under this rule.
XICTRAQ’s cookie-free first-party analytics is built to touch no browser storage — no cookies, no local storage, no cross-device fingerprinting. That removes the reason for a consent banner, and the binary “track or pay” becomes a non-question. Measurement runs in the first-party context on your own domain, not via a third party.
The benefit is twofold: legally the burden of proof vanishes, and in data quality the consent gap closes. Because no banner deters or excludes visitors, virtually every session is captured instead of only the consenting share. That makes the figures more robust than banner-throttled measurement — a point the piece on the GDPR-compliant analytics alternative explores further. Origin and location measurement also stays reliable in the first-party context, as the piece on Chrome IP Protection and geodata shows.
Without access to device storage, the consent duty under Section 25 TDDDG does not apply (Section 25 TDDDG). No banner means no consent gap, no dark-pattern risk, no burden of proof.
Data comes together in the first-party context on your domain and is not mirrored to ad networks — the chain of external data recipients that makes consent so contestable is gone.
Because no banner filters out sessions, the figures are more complete. Instead of only the consenting share, almost all traffic flows into page views, sources and conversions.
What is measured and what is not can be clearly evidenced — useful for the record of processing and for clients who expect a GDPR-compliant basis.
Cookie banners cost more than they bring in
Cookie banners are expensive — not to buy, but in reach and trust. A widely cited study of the five most common consent-management platforms across the 10,000 most-visited websites found that fewer than 12 percent of banners met the minimum legal requirements (Nouwens et al. 2020). At the same time, design tricks — pre-selected options, unequal buttons, hidden rejection — measurably shape user decisions (Nouwens et al. 2020). Such dark patterns are exactly what authorities now warn against.
On the other side sits data loss: a substantial share of visitors ignore banners or reject them, so banner-based statistics see only a slice. Anyone wanting to close that blind spot without piling up legal risk inevitably lands on measurement without a consent duty. The piece on measuring cookie-free after the Privacy Sandbox shutdown shows that robust measurement entirely without cookies is possible — the same logic carries for analytics overall.
An intrusive consent-or-pay banner is the first impression a website leaves. Doing without a banner — because no consent-requiring data collection takes place — typically improves the user experience while lowering legal risk. How to keep remaining consents and embedded scripts cleanly in view is covered by consent and script monitoring.
Out of the consent trap in five steps
- Take stock: check whether your site currently uses a consent-or-pay or a classic cookie banner and which scripts access device storage.
- Clarify the consent need: separate what truly needs cookies (such as cart, login) from what can be measured cookie-free — analytics in almost all cases belongs to the second group.
- Switch to cookie-free measurement: replace banner-required statistics with first-party analytics without device storage that triggers no consent.
- Reduce the banner: once the analytics reason falls away, the banner can often be dropped entirely or trimmed to a few genuine exceptions — documented in the record of processing.
- Monitor continuously: keep an eye on new scripts and embedded services so consent-requiring trackers do not creep back in unnoticed, and evidence your GDPR basis in an auditable way.
Sidestep consent or pay instead of managing it
The new EDPB line makes binary “track or pay” a fading model for most operators (EDPB), and the broader 2026-2027 guidelines will raise the pressure (EDPB Work Programme 2026-2027). Rather than keeping a questionable banner ever more elaborately compliant, the calmer route is to design data collection so that consent and paywall are not needed at all. Anyone who knows the basics of GDPR compliance for websites in 2026 can see: avoiding is easier than managing.
XICTRAQ starts exactly here: cookie-free first-party analytics that touches no browser storage, needs no consent banner and still keeps measurement complete — combined with GDPR tools and cookie and script monitoring that watches embedded services. That leaves the consent-or-pay dilemma where it belongs: with the others.
Start with a free trial and see how complete your figures become without a banner. Or book a personal demo to see cookie-free measurement and GDPR tools in action — without ever asking whether your visitors track or pay.
This article draws on: European Data Protection Board (EDPB), Opinion 08/2024 on valid consent in consent-or-pay models used by large online platforms, adopted 17 April 2024 (binary pattern usually not valid consent, genuine free alternative, data not a tradeable commodity, appropriate low fee); EDPB work programme 2026-2027, adopted 11 February 2026 (broader guidelines on consent or pay); Article 4(11) and Article 7 GDPR (consent conditions and duty to demonstrate); Section 25 TDDDG (consent for storing/reading information on the device); CJEU, case C-252/21 (an appropriate fee as a possible alternative); Nouwens et al. 2020, “Dark Patterns after the GDPR” (fewer than 12 percent of cookie banners minimally compliant, design influences decisions); noyb (422 formal complaints against cookie banners, 42 percent remedied within 30 days, 2024 supervisory decision). Legal statements do not constitute legal advice.