Is It legal to pay to reject cookies in 2025? What the law says and what practices are prohibited
You may have recently noticed that several Spanish newspapers, as well as various German and Austrian media outlets, have introduced a new approach on their websites. Instead of allowing users to reject cookies outright, they offer the option to subscribe to an anti-tracking service for a monthly fee to prevent tracking through these text files.
Subscribing to this service would mean that, on websites implementing this practice, users can browse freely without encountering additional cookie banners beyond the one required to obtain their subscription.
The goal of such services is to maintain user privacy while compensating for the revenue lost due to users rejecting analytical and advertising cookies.
At Lawwwing, we aim to simplify the understanding of current regulations. That’s why we must first ask: Is this option legal?
To answer this question, we must first analyze what the Spanish Data Protection Agency (AEPD) states in its latest Guide on the Use of Cookies, which was updated to align with the European Data Protection Board (EDPB) guidelines published on July 11, 2023. The deadline for implementing these guidelines was set for January 11, 2024.
The guide follows the EDPB’s directives and states that consent is considered freely given only when access to a website’s services and features is not conditional on accepting cookies.
As a result, websites cannot use cookie walls that do not offer an equivalent alternative to accepting cookies. Additionally, users must be able to access the website without being forced to accept cookies, especially if no alternative means of access is provided.
However, in section 3.2.10 of its Cookie Guide, the AEPD opened the possibility of complying with the EDPB’s guidelines as long as an alternative access to the website is provided—even if it is not free.
Therefore, if all the conditions are met—meaning access to the website is not conditioned on accepting cookies, and the website owner offers an equivalent alternative—then a paid alternative to cookie acceptance would be considered legally valid at the national level.
Now that we’ve seen the legal framework,
As established by the EDPB, users must always have the option to reject cookies, even if this option is not prominently displayed.
For this reason, if a website only provides the options to "accept," "pay to reject," or "leave the site," it would not be complying with European guidelines. In this case, the website owner could be subject to penalties from both the AEPD and the EDPB.
However, it's important to note that the AEPD operates at a national level, while the EDPB has yet to issue a definitive stance on this specific matter. So far, the EDPB has only clarified that "for consent to be freely given, access must not be conditioned."
This means that national and European solutions on this issue remain unsettled, and we must wait for the EDPB to take a clear position.
At Lawwwing, we will continue to closely monitor legal developments in this area to provide the most up-to-date solutions.
