Consent-or-pay

❗Article Status Notice: Inappropriate Tone/Word Usage

This article needs additional work to meet the wiki's Content Guidelines and be in line with our Mission Statement for comprehensive coverage of consumer protection issues. Specifically it uses wording throughout that is non-compliant with the Editorial guidelines of this wiki.

Learn more ▼

How You Can Help: If this is a non-Theme article (See: Article types):

• Persuasive language should not be used in the Wiki's voice. Avoid loaded words, or the causing of unnecessary offense, wherever possible.
• No direct attacks on named individuals or companies. Malice may be attributed to bad and proven offenders, but only through the use of quotation and citation - never in the Wiki's voice.

If this is a Theme article:

• Where argumentation is used make sure it is clear and direct but not inflammatory. Avoid strong language, or causing unnecessary offense.
• No direct attacks on named individuals or companies. Malice may be attributed to bad and proven offenders, in a formal and calm manner.

This notice will be removed once sufficient documentation has been added to establish the systemic nature of these issues. Once you believe the article is ready to have its notice removed, visit either the Moderator's noticeboard, or the Discord (join here) and post to the #appeals channel.

Consent-or-pay, or consent-or-okay, is a business tactic in response to the European Union's General Data Protection Regulation (GDPR). Under this model, users of a website must either:

• Consent to the use of cookies and personal data for targeted advertising, or
• Pay a small monthly fee to access the service without tracking.

The practice generated significant debate among regulators, policymakers, and consumer advocates alike and is viewed as undermining meaningful consent. Despite controversy, the model is being increasingly adopted by large online platforms and news organizations. As of August 2025, 16 of the 50 largest UK news websites had implemented consent-or-pay.

Background

Main article: General Data Protection Regulation

The General Data Protection Regulation was passed in 2018 with the aim of protecting online users from excessive data collection by large companies. The regulation does this by requiring companies to allow users to consent to data collection, and this is often done by an opt-in banner or pop-up on the home screen of any given website.

Companies began feeling like they were losing revenue over this new regulation because they could no longer collect data for targeted ads at the same scale they'd done before. This led to the new consent-or-pay model as a workaround.

How it works

When a user visits a website, a pop-up consent window is displayed. Traditional options would be Accept or Reject cookies. However the user is presented with the options to Accept or Pay.

• The payment is typically a low fee (e.g. £1.99 per month).
• Many of the sites that use the model were previously free-to-access and funded primarily through advertising.
• Consumers must now "pay" either with their personal data or with money.

This effectively introduces a paywall for previously freely accessible content even if no traditional subscription model exists.

Why it is a problem

Invalid consent

This binary model of data collection creates the illusion of consent because users are compelled to choose one of two bad options, both of which require loss in exchange for content that is generally considered free access.

Lack of informed consent

Companies often inform users that cookies and data collection are for "personalized ads" and "improving services". What they do not express is how a user's personal data is stored in data centers, shared among third-parties, sold to data brokers, and often become publicized through breaches. Users underestimate the costs of giving away their personal data, believing that advertisements of things they're already interested in makes their data a fair trade-off.

False equivalence

The consent-or-pay model creates a false equivalence between two options. It denotes that the company loses, say, $2 or $5 a month when a user rejects targeted ads. This is an impossible metric considering that there is no way to guess whether the individual user would have purchased any item that is advertised to them. At best, this means the monthly fee is completely arbitrary. At worst, it is based upon a percentage of users who do happen to make purchases and is then unfairly distributed upon all users, irrespective of purchase or ad consumption, which is also known as average revenue per user (ARPU).

Illusion of fair exchange

For users, the consent-or-pay model leads to a false belief that a fair exchange is taking place. When a company asks for a price as low as $2 a month while seeking data collection as a "free" alternative, the user is led to believe that they are fairly reimbursing the company for loss ad revenue, especially for such a low monthly fee. In susceptible users, they may be tricked into believing this is a fair and ethical decision they are making, thus happily choosing to engage in a deliberately misleading practice.

Meta investigation and fine

After a year-long investigation by the European Commission, Meta was fined on 23 April 2025 for failing to comply with the Digital Markets Act (DMA). The European Commission's investigation targeted Meta's consent-or-pay model because it failed to meet the DMA's criteria of reducing personalized data for targeted ads and it does not allow users to freely consent. Consequently, Meta was fined with €228 million in the month of April, and by July, the European Commission warned that the social media company may face accrued daily fines if they continue employing this tactic.

Other uses

News organizations

Many media outlets have adopted consent-or-pay throughout Europe, including:

• The Mirror
• The Independent
• Der Spiegel
• Der Standard
• Le Monde
• Le Parisien
• Corriere della Sera
• MeridioNews
• 
  Screenshot of MeridioNews' consent-or-pay policy appearing after rejecting cookies on one of their articles
• 
  (machine-translated) screenshot of MeridioNews' consent-or-pay policy

Response

Criticisms from policymakers

In 2024, the European Data Protection Board (EDPB) published a non-binding opinion on "Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms." The board denotes that the consent-or-pay model does not constitute as valid consent and that appropriate alternative measures to the model should provide users with an "equivalent alternative". Additionally, they say that if a company wishes to use a payment model, then the opposing equal alternative should not involve processing personal data. Any choice in which users feel compelled to consent does not qualify as valid consent.

Anu Talus, Chair of the EDPB, said:

"Online platforms should give users a real choice when employing 'consent or pay' models. The models we have today usually require individuals to either give away all their data or to pay. As a result most users consent to the processing in order to use a service, and they do not understand the full implications of their choices."

Consumer advocates

noyb is a data protection advocacy organization based in Austria that pays particular attention to the General Data Protection Regulation and its violations . In November of 2023, the advocacy group filed an official complaint with the Austrian Data Protection Authority against tech giant Meta for lacking "any valid legal basis for [pay-or-okay]. [...] Meta is now trying to extort supposed consent from its users with a 'yes or pay' choice". This complaint was due to the significant costs of rejection of personalized ads through Meta's Facebook for €12.99 per month and Instagram for €8 per month, approximating a combined total of €251.88 ($294.74USD) each year. noyb continues to report that the tech giant sets a bad precedent for other social media platforms to follow suit, possibly leading to €35,000 per family for the simple act of data protection.

Effectiveness

The effects of the consent-or-pay model vary widely.

• Advertising Week reported in September of 2023 that only 30% of users accept the cookies after the GDPR.

• Also in 2023, The Drum reported that as much as 40% of users simply use a VPN in order to bypass the regional consent-or-pay web block. A VPN allows users to access webpages by rerouting their IP's to foreign countries, often seen as the most accessible and fair way to protect themselves from privacy violations.

• In 2025, the Press Gazette stated, "When users are equally offered the chance to 'accept all' or 'reject all' cookies, consent rates are typically somewhere around 70-80%, according to both Skovgaards and Contentpass founder Dirk Freytag".

Alternative practices

The Guardian develops a new "contextual advertising" model that bases ads upon whatever page the user is currently viewing (i.e. food ingredients on a recipe page). They say, "It's a perfect advertising product for a privacy conscious brand and a brand doing the right thing." In 2023, they've report a 35% increase in clicks.

See also

Europe-based news sites enact consent-or-pay for data tracking

Years of inactivity in “Pay or OK” cases: noyb sues German DPAs

noyb's Pay or Okay report: how companies make you pay for privacy