EU ePrivacy Directive Cookie Walls

A cookie wall is high risk when it blocks website or app content unless the user accepts cookies, pixels, SDKs, local storage, or similar access to terminal equipment that is not strictly necessary. Article 5(3) ePrivacy analysis starts before GDPR processing analysis: check whether the service stores information on the user's device or gains access to information from it, including through browser cookies, JavaScript, pixels, tracked links, identifiers, or client-side code.

If consent is required, the consent standard is the GDPR standard. The EDPB's consent guidance says consent only works where the user has control and a genuine choice to accept or decline without detriment. For cookie walls, that means a user should not be pushed into believing consent is required for access unless the access condition is tied to a strictly necessary service or functionality that the user explicitly requested.

The EDPB cookie-wall reply also cautions against overclaiming a single blanket answer: it noted that the French court decision discussed there did not decide whether cookie walls are lawful on the merits, and that the ePrivacy Directive remained the applicable framework while consent under ePrivacy had to meet GDPR standards. Treat national implementation and regulator practice as part of the review instead of inventing a universal country rule.

Keep evidence that lets a reviewer reconstruct what the user saw, what technologies ran before and after each choice, and what access remained available without optional consent. The evidence should be tied to the deployed CMP or banner version, not only to a policy statement.

The most important caveat is national law. The Cookie Banner Taskforce states that placement or reading of cookies is assessed under the national law transposing the ePrivacy Directive, while GDPR concepts such as valid consent are indispensable to the analysis. Record the countries in scope and escalate local-law questions when a cookie wall, paid alternative, media access model, or subscription path is material.