EU ePrivacy Directive Cookie Walls

A cookie wall is high risk when it blocks website or app content unless the user accepts cookies, pixels, SDKs, local storage, or similar access to terminal equipment that is not strictly necessary. Article 5(3) ePrivacy analysis starts before GDPR processing analysis: check whether the service stores information on the user's device or gains access to information from it, including through browser cookies, JavaScript, pixels, tracked links, identifiers, or client-side code.

If consent is required, the GDPR consent standard applies. EDPB guidance gives a direct example: blocking content with only an "accept cookies" button does not present a genuine choice, so the consent is not freely given. A cookie wall does not become valid merely because the banner describes tracking or records a click.

The EDPB cookie-wall reply also cautions against overclaiming a single blanket answer: it noted that the French court decision discussed there did not decide whether cookie walls are lawful on the merits, and that the ePrivacy Directive remained the applicable framework while consent under ePrivacy had to meet GDPR standards. Treat national implementation and regulator practice as part of the review instead of inventing a universal country rule.

Keep evidence that lets a reviewer reconstruct what the user saw, what technologies ran before and after each choice, and what access remained available without optional consent. The evidence should be tied to the deployed CMP or banner version, not only to a policy statement.

The most important caveat is national law. The Cookie Banner Taskforce states that placement or reading of cookies is assessed under the national law transposing the ePrivacy Directive, while GDPR concepts such as valid consent are indispensable to the analysis. Record the countries in scope and escalate local-law questions when a cookie wall, paid alternative, media access model, or subscription path is material.