Are Cookie Walls GDPR Compliant?

ON THIS PAGE

Some websites present cookie notices without leaving a choice- the user must click on “Accept” or “Okay”. Such a cookie banner blocks access to a website, and there is no option to decline. This is called a cookie wall.

How do cookie walls work? Are they actually legal? Are cookie walls GDPR-compliant? Are there differences between a cookie wall and a paywall? Read this blog to find out.

What Is a Cookie Wall?

Under privacy laws like the GDPR and ePrivacy Directive, if websites need to use cookies for collecting the personal information of users, they must provide all the necessary information regarding their data collection and management and get cookie consent.

Website users should have the option to accept or decline the cookies. Users should also have the possibility to grant Cookie Consent based on cookie category. There are different types of cookies, and users should have a granular option for cookie settings, granting Cookie Consent just for some types of cookies. Keep in mind that Cookie Consent is not needed for strictly necessary cookies.

A cookie wall is a Cookie Banner that forces website users to accept cookies before they can access the website's content. The user must click on the “Accept” or “Okay” buttons without having a choice to reject the banner. If users do not consent, they are denied access to the website's content. Cookie walls don’t give users the option to customize the types of cookies and user data collection too.

The key elements of a cookie wall are:

  • Denial of access. Users can’t access the website's content unless they consent to the use of cookies.
  • Limited options. Users usually have limited or no options other than to accept cookies. There is no way to access the website’s content without accepting cookies.

Not sure if your website uses cookies? Scan your website for free to see all your website cookies in use.

How Do Cookie Walls Work?

Cookie walls are technical barriers or mechanisms on websites that users can only pass if they provide their data to websites. If users refuse to provide their personal information that could be processed by the websites, they will be denied access to the website’s content. The acceptance or refusal to share this information with websites is being tracked by web technologies.

The final goal of using a cookie wall is collecting and processing as much user data as possible. This data is then used to create detailed profiles of users that can be sold to third parties like marketing agencies.

Are Cookie Walls Allowed Under GDPR?

In most cases of cookie walls, users have no choice for privacy options. Users are not informed about their data collection, or what type of data is collected and stored. They also don’t have the possibility to select or deselect specific categories of cookies.

Such cookie walls are not GDPR-compliant, as they do not inform users about their data collection and management activities and do not allow granular settings options. 

Under the GDPR, websites must give access to services even if the user refuses to consent. Users cannot be discriminated against if they don’t grant consent for the collection and use of their data. 

 

An example of a cookie wall that forces users to grant consent for the collection and processing of their data. It’s not GDPR-compliant since users can’t reject cookies.

In some cases, instead of blocking access to a website, a huge cookie banner appears centrally on the website, hiding all the background of a website that is not displayed until the user chooses privacy options. This is not a cookie wall since with this type of Cookie Banner, the user has a real choice to accept or reject cookies. User can access the website’s content even if they do not consent to the collecting and processing of their personal data.

Such an aggressive Cookie Banner is GDPR-compliant, provided that the Cookie Banner meets all the requirements for collecting valid Cookie Consent.

An example of a Cookie Banner by Google- even if it’s an aggressive way to collect Cookie Consent, this Cookie Banner is not a cookie wall and it is GDPR-compliant since users have the choice to accept or reject cookies.

Are Cookie Walls Legal in the EU?

Cookie walls are not allowed under the GDPR. However, each EU country has an independent Data Protection Authority that sets the rules regarding personal data protection. Data Protection Authorities implement the GDPR into national laws, and the national regulations can be different in some details.

Each EU country has distinct regulations regarding the usage of cookie walls. The use of cookie walls in the EU is only allowed when you fulfill strict conditions determined by EU Data Protection Authorities.

Let’s examine the legacy of cookie walls in major European countries.

Are Cookie Walls Legal in France?

Cookie walls are legal in France but must meet specific criteria outlined by the French Data Protection Authority (CNIL).

CNIL provided guidance on cookie walls, and a website can only use cookie walls if it satisfies all listed criteria:

  • Websites must provide a real and fair alternative to the website’s content.
  • Websites could use paywalls, but the price of a paywall must be reasonable.
  • User account creation must correspond to specified purposes.
  • Cookie walls and paywalls must correspond to specified cookie purposes.
  • If users choose an alternative to cookie walls, only necessary cookies could be used.

Are Cookie Walls Legal in the UK?

The UK Data Protection Authority- the Information Commissioner’s Office (ICO) allows the use of cookie walls if you meet certain conditions:

  • Website users must have a genuine and free choice.
  • Website users must have the possibility to access website services without the acceptance of cookie walls unless cookies are necessary for that service.

Are Cookie Walls Legal in Italy?

The Italian Data Protection Authority does not allow the use of cookie walls on Italian websites.

Are Cookie Walls Legal in Germany?

Germany does not allow cookie walls.

Are Cookie Walls Legal in Belgium?

Belgium does not allow cookie walls.

Are Cookie Walls Allowed Under CCPA?

Neither the California Consumer Protection Act (CCPA) nor the amendments from the California Privacy Rights Act (CPRA) regulate cookie usage except for when minors are involved.

Under the CCPA and the CPRA, you can use cookies walls unless you inform website users about the collection and processing of their personal data. You can inform users about their personal data management with the help of a cookie wall or with other methods like a cookie banner or a cookie policy.

What Is a Paywall?

Don’t confuse a cookie wall with a paywall. A paywall is a method that restricts access to online content just to paying subscribers. Often you can access content for a set period of time before you're forced to pay.

Using paywalls is absolutely legal since they do not collect any personal data of users, it’s simply a business model of news sites of other websites to sell their services.

It’s just the opposite- it is generally not legal to disable or bypass a paywall. Even if you have paid access to a website, download articles, and make them available for free- it’s not legal since you can break copyright laws.

Cookie Banner: the Alternative to a Cookie Wall

In conclusion, while cookie walls are not explicitly banned under GDPR, each EU country sets its own regulations for the usage of cookie walls. These regulations are different, and hard to fulfill, and it takes time to understand those nuances.

Therefore, it is advised to use alternative mechanisms. The most common cookie wall alternatives are cookie consent banners.

Unlike cookie walls, cookie banners give website users several options options:

  • Accept all cookies.
  • Deny all cookies.
  • Granular consent, when users can consent just to selected categories of cookies.

The easiest way to implement a Cookie Banner on your website is by using a professional Consent Management Platform (CMP) like CookieScript.

CookieScript CMP offers the following functionalities for your cookie banner:

Frequently Asked Questions

What Is a Cookie Wall?

A cookie wall is a cookie banner that forces website users to accept cookies before they can access the website's content. Users must click on the “Accept” or “Okay” buttons without having a choice to reject the banner. Each EU country sets its own regulations for the usage of cookie walls, so it is recommended to use a cookie banner instead of a cookie wall.

Are Cookie Walls Allowed Under GDPR?

While cookie walls are not explicitly banned under GDPR, each EU country sets its own regulations for the usage of cookie walls. These regulations are different, hard to fulfill, and it takes time to understand those nuances. Therefore, it is recommended to use alternative mechanisms like cookie consent banners. With CookieScript, you can create a professional and privacy laws-compliant cookie banner.

Are Cookie Walls Legal in the UK?

The UK Data Protection Authority- the Information Commissioner’s Office (ICO) allows the use of cookie walls if you meet certain conditions. However, to comply with DPA 2018, it is recommended to use alternative mechanisms like cookie consent banners. With CookieScript, you can create a professional and privacy laws-compliant cookie banner.

Are Cookie Walls Legal in Italy?

The Italian Data Protection Authority does not allow to use cookie walls on Italian websites. Use instead alternative mechanisms like cookie consent banners. CookieScript CMP allows you to create a professional and GDPR-compliant cookie banner.

Are Cookie Walls Legal in Germany?

Germany does not allow cookie walls. You should use alternative mechanisms like cookie consent banners. CookieScript CMP allows you to create a professional and GDPR-compliant cookie banner, that is legal in Germany.

Are Cookie Walls Legal in Belgium?

Belgium does not allow cookie walls. Use cookie consent banners instead of cookie walls to comply with the GDPR. CookieScript CMP allows you to create a professional and GDPR-compliant cookie banner.

Are Cookie Walls Legal in France?

Cookie walls are legal in France but must meet specific criteria outlined by the French Data Protection Authority (CNIL). However, it is recommended to use cookie consent banners instead of cookie walls. CookieScript CMP allows you to create a professional cookie banner that complies with CNIL.

Are Cookie Walls Allowed Under CCPA?

Under the CCPA and the CPRA, you can use cookies walls unless you inform website users about the collection and processing of their personal data. Instead of a cookie wall, you can also use a cookie consent banner or a Cookie Policy. CookieScript CMP allows you to create a professional cookie banner and a Privacy Policy for your website that complies with the CCPA.

What Is a Paywall?

A paywall is a method that restricts access to online content just to paying subscribers. Differently from a cookie wall, using paywalls is absolutely legal since they do not collect any personal data of users. It is generally not legal to disable or bypass a paywall since you can break copyright laws.

Is it legal to disable or bypass a paywall?

A paywall is a method that restricts access to online content just to paying subscribers. Depends on the country, but in general, privacy laws do not allow to disable or bypass a paywall. Even if you have paid access to a website, download articles, and make them available for free- it’s not legal since you can break copyright laws.