Back to Intelligence Hub
regulationEuropean UnionRisk Level: high
EDPB Pay-or-Consent Cookie Walls May 2026: Updated Guidance, Consent Validity & Advertiser Web Tracking Workflow
The EDPB published refreshed pay-or-consent guidance in May 2026 that materially restricts the binary cookie wall pattern and tightens consent validity criteria across the EU. Here is the advertiser-side workflow.
Quick Answer
The EDPB's May 2026 pay-or-consent guidance materially restricts the binary cookie wall pattern and tightens consent validity criteria across the EU. Subscription-as-consent-alternative models must offer comparable functional equivalence; consent must remain genuinely freely given under GDPR Article 4(11).
EDPB May 2026 Pay-or-Consent Guidance
The European Data Protection Board published a refreshed guidance document on consent and the so-called pay-or-consent or consent-or-pay model in May 2026. The document builds on the April 2024 Opinion 08/2024 that the EDPB issued in response to a referral from the Dutch, Norwegian, and Hamburg supervisory authorities and that addressed the validity of consent obtained when users face a binary choice between accepting tracking and paying for an alternative version of the service.
The May 2026 guidance broadens the scope to cover any service that offers a pay-or-consent configuration regardless of platform size, addresses additional configuration variations beyond the strict binary choice, and provides operational criteria that supervisory authorities apply when assessing consent validity. The guidance reflects developments in case law since April 2024 and produces a consolidated regulatory position that supervisory authorities can apply consistently across the EU.
The guidance reaches three core conclusions. First, the binary pay-or-consent choice does not produce valid consent under GDPR Article 4(11) and Article 7 in most consumer-facing configurations because the choice is not freely given. Second, multi-tier configurations that offer at least three meaningful alternatives — accept tracking, pay for ad-free, or accept a tracking-light alternative with reduced personalisation — can produce valid consent under specific design criteria. Third, the price differential between the consent option and the paid alternative must be reasonable and proportionate to the value of the data processed under the consent option.
"The binary cookie wall is no longer a viable compliance pattern in consumer-facing configurations. The multi-tier alternative is operationally more complex but produces sustainable EU campaign capability."
— AuditSocials EU privacy brief, May 2026
For the broader EU regulatory frame, see EU DSA Compliance. Track in-flight EDPB guidance through the Policy Tracker.
Consent Validity Criteria
The May 2026 EDPB guidance applies four cumulative consent validity criteria to pay-or-consent configurations and to other tracking consent mechanics. The criteria operate cumulatively — failure on any single criterion produces invalid consent regardless of compliance with the others.
Cumulative Criteria Under GDPR Article 4(11)
| Criterion | Definition | Pay-or-Consent Failure Mode |
|---|---|---|
| Freely given | Genuine choice without coercion | Alternative materially worse than consent option |
| Specific | Unbundled per processing purpose | Bundled consent for unrelated purposes |
| Informed | Plain-language disclosure of purposes, recipients, retention | Buried multi-layer policy without surface summary |
| Unambiguous | Affirmative action; not implied or pre-selected | Pre-checked consent or dark-pattern nudge |
For automated audit of advertising consent infrastructure, run AI Compliance Audit.
IAB TCF Alignment
The IAB Transparency and Consent Framework is the dominant industry-side consent infrastructure that the European advertising ecosystem uses to communicate consent decisions across the supply chain. The May 2026 EDPB guidance interacts with the TCF in several specific ways and the IAB has been updating the framework to align.
TCF Update Direction
- Default consent values prohibited: Consent strings must reflect explicit user decision, not defaults
- Purpose-level granularity: Each of the eleven defined purposes captured separately
- Vendor-level consent: Captured per vendor processing the user's data
- Legitimate-interest claims: Restricted; require documented balancing tests
- TCF v2.4 (Q3 2026): Refined consent string format, GPC integration, cross-context advertising purpose
For automated review of advertising consent infrastructure, run AI Compliance Audit. Reference the cross-platform regulatory frame through Google Consent Mode v2 implementation guide.
Advertiser Web Tracking Workflow
The May 2026 EDPB guidance triggers a wave of cookie wall reconfigurations across European publisher and platform inventory. Advertisers running EU campaigns should expect inventory volatility during Q2 and Q3 2026 as publishers adjust their consent configurations.
Advertiser-Side Workstream Summary
| Workstream | Duration | Output |
|---|---|---|
| Publisher inventory audit | 4-8 weeks | Allowlist, watchlist, denylist |
| Contractual update | 6-12 weeks | Consent representations, audit rights, indemnification |
| Consent string verification | 4-8 weeks | TCF format validation, suppression logic, anomaly logging |
| Platform configuration | 6-12 weeks | Audience exclusion, conversion API consent propagation |
| Tracking-light capability | 8-16 weeks | Contextual targeting, non-cross-context measurement |
For multi-jurisdiction audit of consent infrastructure, run Legal Compliance Scan.
EU Web Campaign Compliance Checklist
- [ ] Audit every publisher partnership against the May 2026 guidance criteria
- [ ] Build allowlist, watchlist, and denylist by compliance status
- [ ] Update publisher contracts with consent validity representations and audit rights
- [ ] Verify IAB TCF consent string format on every impression
- [ ] Suppress advertising delivery when consent string indicates non-consent
- [ ] Log consent string contents for accountability response
- [ ] Configure Meta, Google, LinkedIn, and X audience exclusion for non-consenting users
- [ ] Propagate consent decisions through conversion APIs to all platforms
- [ ] Develop tracking-light campaign capability with contextual targeting
- [ ] Plan for IAB TCF v2.4 transition during Q3 and Q4 2026
- [ ] Commission third-party consent infrastructure audit before end of Q3 2026
- [ ] Track in-flight EDPB and supervisory authority guidance through the Policy Tracker
Frequently Asked Questions
What did the EDPB publish in its May 2026 pay-or-consent guidance and how does it differ from the April 2024 opinion?
The European Data Protection Board published a refreshed guidance document on consent and the so-called pay-or-consent or consent-or-pay model in May 2026. The document builds on the April 2024 Opinion 08/2024 that the EDPB issued in response to a referral from the Dutch, Norwegian, and Hamburg supervisory authorities and that addressed the validity of consent obtained when users face a binary choice between accepting tracking and paying for an alternative version of the service. The May 2026 guidance extends the April 2024 opinion in several material ways. The April 2024 opinion focused narrowly on large online platforms within the meaning of the DSA and addressed the binary choice configuration that Meta introduced in late 2023. The May 2026 guidance broadens the scope to cover any service that offers a pay-or-consent configuration regardless of platform size, addresses additional configuration variations beyond the strict binary choice, and provides operational criteria that supervisory authorities apply when assessing consent validity. The May 2026 guidance also reflects developments in case law since April 2024. Several national supervisory authorities issued enforcement decisions on pay-or-consent configurations during 2024 and 2025, the Court of Justice of the European Union addressed adjacent questions in several preliminary references, and the European Commission's review of the ePrivacy framework produced clarifications that the May 2026 guidance incorporates. The combined effect is a consolidated regulatory position that supervisory authorities can apply consistently across the EU. The May 2026 guidance reaches three core conclusions. First, the binary pay-or-consent choice does not produce valid consent under GDPR Article 4(11) and Article 7 in most consumer-facing configurations because the choice is not freely given. Second, multi-tier configurations that offer at least three meaningful alternatives — accept tracking, pay for ad-free, or accept a tracking-light alternative with reduced personalisation — can produce valid consent under specific design criteria. Third, the price differential between the consent option and the paid alternative must be reasonable and proportionate to the value of the data processed under the consent option. The proportionality assessment is fact-specific and varies by service category. From the advertiser perspective the May 2026 guidance triggers a wave of cookie wall reconfigurations across European publisher and platform inventory. Advertisers running EU campaigns should expect inventory volatility during Q2 and Q3 2026 as publishers adjust their consent configurations, and audience targeting that depended on broad consent rates may face material reach reduction. For the broader EU regulatory frame, see EU DSA Compliance and track in-flight EDPB guidance through the Policy Tracker.
What are the consent validity criteria under the May 2026 EDPB guidance and how should advertisers verify supplier compliance?
The May 2026 EDPB guidance applies four cumulative consent validity criteria to pay-or-consent configurations and to other tracking consent mechanics. The criteria are derived from GDPR Article 4(11) and Article 7 and from the ePrivacy framework, and the criteria operate cumulatively — failure on any single criterion produces invalid consent regardless of compliance with the others. The first criterion is freely given. Consent must be a genuine choice rather than an artefact of coercion or detrimental consequence. The pay-or-consent configuration produces a freely-given consent failure when the alternative to consent is materially worse than the consent option in a way that effectively coerces consent. The May 2026 guidance specifies that price differential, feature parity, and access timing all factor into the freely-given assessment. The second criterion is specific. Consent must be specific to the purposes for which the data is processed rather than a generic acceptance of unspecified processing. The pay-or-consent configuration produces a specificity failure when the consent option bundles multiple purposes including some that are not necessary to deliver the service. The May 2026 guidance specifies that consent must be unbundled per purpose at sufficient granularity to support meaningful user choice. The third criterion is informed. Consent must be informed by clear and plain-language disclosure of the data categories, purposes, recipients, retention periods, and withdrawal mechanism. The pay-or-consent configuration produces an informed-consent failure when the disclosure is buried in a multi-layer privacy policy without surface-level summary, when the disclosure uses jargon that consumers cannot understand, or when the disclosure omits material information about cross-context behavioural advertising or third-party data sharing. The fourth criterion is unambiguous. Consent must be communicated through a clear affirmative action rather than implied through inaction or pre-ticked boxes. The pay-or-consent configuration produces an unambiguous-consent failure when the consent option is pre-selected, when the consent button is highlighted while the paid alternative is de-emphasised, or when the consent flow uses dark pattern design to nudge users toward consent. From the advertiser perspective the verification of supplier compliance with the consent validity criteria is operationally challenging because advertisers do not control the publisher-side consent flow. The recommended approach is to require contractual representations from publishers about consent validity, to obtain the IAB TCF consent string with each impression and verify the consent string format, to conduct periodic audits of publisher consent flows, and to maintain a publisher allowlist that excludes publishers with known non-compliant flows. Audit firms have begun offering pay-or-consent compliance assessments that advertisers can use to validate the publisher inventory. For automated audit of advertising consent infrastructure, run AI Compliance Audit.
How do cookie wall mechanics work after the May 2026 guidance and what configurations remain compliant?
Cookie wall mechanics operate as the primary user-facing surface where consent for tracking is captured and as the principal configuration that the EDPB pay-or-consent guidance addresses. The May 2026 guidance does not prohibit cookie walls outright but tightens the conditions under which cookie walls produce valid consent and identifies several configurations that fail the validity criteria. The compliant configuration after the May 2026 guidance is a multi-tier model that offers users at least three meaningful alternatives and that satisfies the cumulative validity criteria. The first tier is the consent option where the user accepts tracking for personalised advertising and gains access to the service at the standard configuration. The second tier is the paid alternative where the user pays a reasonable fee and gains access to an ad-free or tracking-light version of the service. The third tier is the tracking-light alternative where the user accesses a version of the service with contextual or non-tracked advertising at no cost. The three-tier model satisfies the freely-given criterion when each tier provides a meaningful service experience rather than a degraded version designed to nudge toward consent. The price differential between the consent tier and the paid tier must be reasonable and proportionate. The May 2026 guidance does not specify a numeric ceiling but identifies factors that supervisory authorities apply when assessing reasonableness. Factors include the actual revenue per user that the service generates from advertising under the consent tier, the marginal cost of providing the paid tier, the broader market price for similar services, and the user demographics that face the choice. Several national supervisory authorities have indicated that price differentials of more than two to three times the average revenue per user warrant scrutiny. The tracking-light alternative is the most operationally complex tier because the configuration must reduce tracking enough to satisfy the alternative criterion while remaining commercially viable for the service. The May 2026 guidance specifies that the tracking-light tier must use contextual advertising rather than behavioural advertising, must not employ cross-context audience identifiers, must not contribute to lookalike audience modelling for downstream advertisers, and must not share user data with third parties beyond the immediate advertising delivery. Several configurations are non-compliant after the May 2026 guidance. The strict binary cookie wall — accept or leave — does not produce valid consent in consumer-facing configurations. The pseudo-binary wall — accept or pay an unreasonable fee — does not produce valid consent because the price differential coerces the choice. The dark pattern wall — accept is highlighted, paid alternative is de-emphasised — does not produce valid consent because the configuration violates unambiguous-consent. The preselected wall — consent is pre-checked, user must affirmatively de-select — does not produce valid consent for the same reason. From the advertiser perspective the cookie wall configuration of the publisher inventory directly affects audience reach and targeting precision. Advertisers running EU campaigns should expect non-compliant publishers to either reconfigure their walls during Q2 and Q3 2026 or to face enforcement action. For audit of advertiser-side consent infrastructure, run AI Compliance Audit and reference the consolidated EU regulatory frame through EU DSA Compliance.
How does IAB Transparency and Consent Framework integration align with the May 2026 EDPB guidance?
The IAB Transparency and Consent Framework is the dominant industry-side consent infrastructure that the European advertising ecosystem uses to communicate consent decisions across the supply chain. The framework operates through a structured consent string format that publishers generate at the user consent moment and that propagates through ad-tech platforms, demand-side platforms, supply-side platforms, and advertiser conversion infrastructure. The framework has been updated several times in response to EDPB guidance and to enforcement decisions from national supervisory authorities. The May 2026 EDPB guidance interacts with the IAB TCF in several specific ways. The guidance reinforces the requirement that consent strings must accurately reflect the user's consent decision rather than apply default consent values when the user has not explicitly opted in. The earlier framework allowed publishers to apply default consent values for some configurations, and the May 2026 guidance closes that approach for any pay-or-consent or consent-or-pay configuration. The guidance addresses the granularity of consent that the framework captures. The TCF supports consent capture at the purpose level — there are eleven purposes defined in the current TCF version — and at the vendor level for the specific ad-tech vendors involved in the supply chain. The May 2026 guidance specifies that purpose-level consent must be captured at the granularity that supports meaningful user choice and that vendor-level consent must be captured for each vendor that processes the user's data. The TCF's purpose and vendor structure can satisfy the granularity requirement when configured correctly. The guidance addresses the legitimate-interest legal basis claim that the TCF supports for several purposes. The TCF allows publishers to declare that some processing operates under the legitimate-interest legal basis rather than under consent, and the framework propagates the legitimate-interest claim through the supply chain. The May 2026 guidance restricts the use of legitimate interest in line with the broader CJEU jurisprudence and specifies that publisher declarations of legitimate interest must be supported by documented balancing tests. Advertisers running EU campaigns through the TCF should not assume that publisher legitimate-interest declarations are categorically valid. The IAB and the European IAB have been updating the TCF specification through Q1 and Q2 2026 to align with the May 2026 EDPB guidance. The updated specification — TCF version 2.4 — is expected to ship in Q3 2026 and will include refinements to consent string format, additional purpose definitions for cross-context behavioural advertising, and tighter integration with the GPC signal where the GPC signal is recognised. Advertisers running EU campaigns should plan for the TCF transition during Q3 and Q4 2026, and the transition may require coordination with ad-tech vendors, demand-side platforms, and conversion measurement infrastructure. For automated review of advertising consent infrastructure, run AI Compliance Audit and reference the cross-platform regulatory frame through Google Consent Mode v2 implementation guide.
What practical workflow should advertisers running EU web campaigns follow to align with the May 2026 EDPB guidance?
The practical workflow for advertisers running EU web campaigns to align with the May 2026 EDPB guidance involves five workstreams that should run in parallel during the second and third quarters of 2026. Advertisers running large-scale EU campaigns should treat the May 2026 guidance as a forced consent infrastructure reset rather than an incremental tightening, and resourcing should reflect the operational burden. The first workstream is publisher inventory audit. Every active publisher partnership should be reviewed against the May 2026 guidance to determine which publishers operate compliant cookie wall configurations and which publishers operate configurations that face enforcement risk. The audit produces a publisher allowlist that excludes publishers with known non-compliant configurations, a watchlist of publishers under remediation, and a denylist of publishers whose configurations cannot be remediated within the enforcement timeline. The audit typically takes four to eight weeks for a multi-publisher advertiser. The second workstream is contractual update with retained publishers. Publisher partnership contracts should be updated to include explicit consent validity representations, audit rights for the advertiser to verify the publisher's consent flow, indemnification scoped to consent-failure-related liability, and termination rights for sustained non-compliance. The contract update process typically takes six to twelve weeks and may require legal review per publisher. The third workstream is consent string verification infrastructure. The advertiser's ad-serving infrastructure should be configured to verify the IAB TCF consent string format on every impression, to log consent string contents for accountability, to suppress advertising delivery when consent string contents indicate non-consent, and to flag consent string anomalies for investigation. The infrastructure workstream typically takes four to eight weeks depending on the existing technical baseline. The fourth workstream is downstream platform configuration. Each ad platform — Meta, Google, LinkedIn, X — must be configured to honor consent decisions communicated through the TCF and through the platform-side consent integration. The configuration includes audience exclusion for non-consenting users, conversion API integration with consent string propagation, lookalike audience exclusion for non-consenting seeds, and Privacy Sandbox alignment where applicable. The workstream typically takes six to twelve weeks across platforms. The fifth workstream is tracking-light campaign capability. Advertisers running campaigns at scale should develop the capability to run tracking-light campaigns aligned with the publisher tracking-light tier under the May 2026 guidance. The capability includes contextual targeting infrastructure rather than behavioural targeting, conversion measurement that operates without cross-context identifiers, creative versioning for tracking-light placements, and reporting infrastructure that supports tracking-light campaign analysis. The capability investment is more significant than the other workstreams but produces sustainable EU campaign capability under the post-May 2026 regulatory frame. Advertisers should commission a third-party consent infrastructure audit before the end of Q3 2026 to validate the workstream output and to identify residual gaps. For end-to-end audit of advertising consent infrastructure, run AI Compliance Audit and reference the consolidated EU regulatory framework through EU DSA Compliance.
How does the EDPB pay-or-consent guidance interact with national supervisory authority enforcement and with the DSA framework?
The EDPB pay-or-consent guidance is a coordination instrument that produces consistent regulatory interpretation across the European Union but does not displace the enforcement authority of the national supervisory authorities. Each member state's data protection authority retains primary enforcement responsibility for GDPR violations within its jurisdiction, and several authorities have been particularly active on pay-or-consent enforcement during 2024 and 2025. The Italian Garante, the French CNIL, the German BfDI and the German state authorities, the Dutch Autoriteit Persoonsgegevens, the Spanish AEPD, and the Norwegian Datatilsynet have each issued enforcement decisions on pay-or-consent configurations or have publicly indicated intent to act on configurations that fail the validity criteria. The May 2026 guidance consolidates the regulatory position that these authorities apply and reduces the previous variation in interpretation across member states. The consistency benefit operates in both directions for advertisers. Advertisers running cross-border campaigns benefit from a single regulatory standard rather than navigating member-state-specific interpretations, and publishers benefit from clearer compliance criteria. The downside is that the consolidated standard is materially tighter than the previously most-permissive member state interpretation, and configurations that survived under permissive interpretations face elevated enforcement risk under the consolidated standard. The interaction with the DSA framework operates through several channels. The DSA framework imposes its own obligations on Very Large Online Platforms including transparency obligations on advertising under Article 26, ad repository obligations under Article 39, and minor protection obligations under Article 28. The DSA obligations operate alongside the GDPR consent obligations and produce overlapping regulatory exposure for VLOPs. The May 2026 EDPB guidance specifically addresses the interaction with DSA Article 26 and clarifies that DSA-required disclosures do not satisfy GDPR consent obligations and vice versa. Platforms must comply with both frameworks in parallel. The enforcement coordination between data protection authorities and Digital Services Coordinators that the DSA establishes has matured during 2025 and 2026 and produces coordinated enforcement actions where the underlying conduct triggers both frameworks. Pay-or-consent configurations operated by VLOPs face coordinated scrutiny from data protection authorities under GDPR and from Digital Services Coordinators under DSA, and the coordination produces faster enforcement timelines than either framework alone would produce. Advertisers running campaigns on VLOP inventory should expect platform-side configuration changes through Q3 and Q4 2026 as the platforms align with the coordinated enforcement direction. For the broader DSA framework see EU DSA second wave VLOP designations. For automated audit of advertising consent infrastructure across platforms, run Legal Compliance Scan.
Don't miss the next policy change.
Create a free account — track every policy change across 8 platforms, get instant alerts, and access every free compliance tool. Or try our Meta Rejection Predictor first.
Report Keywords — Run AI Compliance Audit
#EDPB#Pay or Consent#Cookie Wall#GDPR#Consent Validity#Web Tracking#TCF#ePrivacy#2026 Policy#Advertisers#Compliance Guide 2026#Privacy
Related Posts
EU Political Advertising Regulation (TTPA) in 2026: Transparency Notices, Targeting Limits and the Platform Exit
The EU's Political Advertising Regulation now governs every political and issue ad in the bloc — with strict transparency, a near-total bar on profiled targeting, and a third-country sponsor ban that pushed Meta and Google out.
Deepfake Political Ads 2026 — Platform-by-Platform Detection, Disclosure & Advertiser Liability
Deepfake political ads 2026: where seven platform policies diverge, when FCC and FEC rules apply, and how advertiser liability shifts when synthetic likenesses appear in paid placements.
DSA Article 22 Trusted Flagger Q2 2026: Designations, Notice Velocity, Platform Response SLA & Advertiser Implications
Article 22 Trusted Flagger designations are reshaping platform takedown velocity across the EU. The framework requires platforms to prioritise notices from designated flaggers — with material implications for advertiser content removal risk.