Why do websites make you pay if you reject cookies?

You tap through to the match report on the bus home and, before the first line loads, a box offers two doors: accept cookies and read for free, or pay a couple of pounds a month and keep the trackers out. Is that cookie wall allowed? In the UK, "consent or pay" is lawful if the price is reasonable, the paid version is genuinely comparable and the choice is put to you fairly; the regulator said so in January 2025. What the law never allows is carrying on tracking you after you have said no.

That box is the latest move in a fifteen-year argument over a file a few bytes long. Regulators wanted your refusal to mean something, publishers needed advertising to keep the news free, and along the way a newspaper in Vienna, a court in Luxembourg and Meta each pushed the argument a step further.

In a hurry? Jump to whether it is legal, what you can do or the most common questions.

What are cookies?

Cookies are small files a website stores in your browser so that it, or its advertising partners, can recognise you on your next visit. Think of the ink stamp on the back of your hand at a gig. It says nothing about who you are, but every steward who checks it knows you have paid and which bar you can get into. Some stamps simply let you in, like the cookie that keeps you logged in; others follow you round the venue and tell the sponsors where you lingered.

The UK rules sit in the Privacy and Electronic Communications Regulations 2003, known as PECR, and they cover pixels and other tracking techniques too. Cookies that are strictly necessary need no permission. Since February 2026, nor do those that only measure how a site is used or remember your preferences, as long as the site tells you and lets you object for free. Advertising cookies always need your consent, and that consent is what the wall is about.

How did cookie banners start?

With a 2011 law that required your consent, and a regulator that softened it a year later. Here is the whole story at a glance:

From 26 May 2011, an amendment to PECR meant non-essential cookies needed your consent. The Information Commissioner's Office (ICO), the regulator in Wilmslow, gave websites a year to adapt. On the eve of the deadline in May 2012 it revised its guidance to accept implied consent: if you had been told about cookies and kept browsing, that counted as a yes.

Hence a decade of "by continuing to use this site, you agree". The GDPR raised the bar for consent in 2018, and in July 2019 the ICO drew the consequences. Browsing on no longer counted, analytics cookies needed consent too, and a wall that let you in only if you accepted would be inappropriate in many circumstances.

Why did "reject all" hurt newspapers?

Because once refusing became as easy as accepting, enough readers refused to dent the advertising that pays for free news. After Brexit the government briefly pointed the other way. In August 2021 the Culture Secretary, Oliver Dowden, promised to cut back on cookie pop-ups, but the bill meant to do it fell with the 2024 general election.

The ICO, meanwhile, tightened its grip. In November 2023 it gave many of the UK's most visited websites 30 days to make "Reject all" as easy as "Accept all". By the end of January 2024, 38 of the 53 companies it had contacted had changed their banners.

For publishers, the sums moved with the button. Industry figures quoted by Press Gazette expected up to 30% of readers to reject, and the Guardian later said that 30% of its users had done so in 2023. A reader who refuses tracking is worth roughly half as much to advertisers, according to a consent firm interviewed by the same outlet.

Where did the idea of paying come from?

From Vienna, where a newspaper turned a paid subscription into the alternative to consent in 2018. The Austrian daily derStandard launched PUR, a version with no tracking and no personalised ads, in January 2018, and made it the alternative to consent once the GDPR took effect that May. Der Spiegel and Zeit Online followed in 2020, and the German-speaking press still calls it the "Pur-Abo".

The model spread through a case about something else. In July 2023, ruling on the German competition authority's action against Meta, the EU's top court said that users who refuse should be offered an equivalent alternative, and qualified it with six words that would travel far:

"if necessary for an appropriate fee"

Privacy campaigners called them an aside. Meta read them as a green light and, on 30 October 2023, announced a subscription for no ads across the EU at €9.99 a month on the web, saying the Court had recognised the model as a valid form of consent. EU regulators pushed back, but by then the UK had left the EU, and their views did not bind the ICO.

Why did British news sites start charging in 2024?

Because the regulator had made "reject all" unavoidable and, within weeks, signalled that a paid alternative could be lawful. In March 2024 the ICO opened a call for views and said that data protection law did not prohibit "consent or pay" in principle. That summer The Times, The Sun, Mail Online, the Mirror, the Express and The Independent rolled out their walls.

Press Gazette reported the prices at launch: £1.99 a month for the Mirror and the Express, £2.70 for Mail Online, £4 for The Independent, £4.99 for The Sun and £6.99 for The Times. In March 2025 the Guardian launched Ad-Lite at £5, explaining that the ads it shows to readers who reject personalisation earn less. By August 2025, 16 of the 50 biggest UK news websites used the model, while The Times had swapped its wall for a free choice between accepting and rejecting.

Meta followed in September 2025 with a UK subscription at £2.99 a month on the web, and the ICO welcomed it as a fair choice at close to half the EU price. What Meta does with your posts is another matter, covered in our guide to stopping Meta and LinkedIn training AI on your content.

Is "consent or pay" legal in the UK?

Yes, if it passes the four tests the ICO set out in January 2025. Its guidance starts from the premise that the law allows the model, and then asks:

• Is there a power imbalance? If you cannot easily switch to a comparable service, your choice is less free, and readers who relied on a site before the wall went up deserve particular care.
• Is the fee appropriate? The price has to be one at which you can still freely give or refuse consent.
• Are the two versions equivalent? Both should offer broadly the same core service.
• Is the choice fair? Refusing has to be as easy as accepting, with no tricks in the design.

In one of the ICO's worked examples, a news site whose only alternative was a premium subscription failed the fee test and had to add a cheaper plan with the news and no personalised ads. No regulator or court has yet said that any real UK newspaper's price is too high or too low.

Two changes in 2026 raised the stakes. Since 5 February, breaking the cookie rules can cost a business up to £17.5 million or 4% of its worldwide turnover, the same top tier as the UK GDPR. Since 30 September, the ICO's powers have belonged to a new body, the Information Commission, which still goes by ICO and is reviewing its consent or pay guidance in light of the new law. The same rules and the same regulator cover the whole UK, Northern Ireland included.

Is it different in the EU?

Yes, and the line there is still moving. The UK no longer follows EU regulators, and they have read the Court's six words more narrowly:

• The European Data Protection Board, which brings the EU's regulators together, told large platforms in April 2024 to consider a further free option with no behavioural advertising. Its general guidelines on the model are still unpublished.
• In Austria, a court found in August 2025 that derStandard ran its wall unlawfully, because one click accepted every purpose at once.
• In Germany, the data protection authorities insisted in September 2026 that the tracking-free alternative must be genuinely equivalent.
• The European Commission fined Meta €200 million in April 2025 under its rules for the biggest digital platforms.

The EU is also negotiating a rewrite of its cookie rules. Whatever comes of it, it will not apply in the UK.

A word on who is telling you this. PASSAS is a firm of lawyers admitted in Spain: we practise EU law and hold no qualification in any part of the UK. The seam where UK and EU rules have pulled apart since Brexit is the ground we work on every day, and the author of this guide studied advanced European law at King's College London and EU law at the Academy of European Law in Florence. That is why the UK rules in this guide link to the legislation and to the regulator's own pages.

What can you do when a site asks you to accept or pay?

Decide calmly, change your mind whenever you like, and complain if a site ignores your no.

1. Withdraw consent as easily as you gave it. Look for a footer link called something like "Privacy settings", "Manage cookies" or "Cookie preferences". If accepting took one click, refusing should not take ten.
2. Clear what is already stored. Every browser lets you delete site data from its privacy settings, for one site or for all.
3. Limit tracking across sites. Safari has "Prevent cross-site tracking", Firefox has "Enhanced Tracking Protection" and Chrome lets you block third-party cookies under "Privacy and security". Menus change, so search the settings by name.
4. Complain in the right order. Start with the site: organisations must now give you an easy way to complain about how they use your personal data, and acknowledge your complaint within 30 days. Then go to the ICO. Its cookie reporting tool feeds its monitoring and brings no individual reply, while a data protection complaint is handled case by case.

The essentials

The cookie wall is the publishers' answer to a regulator that made "reject all" easy, built on a model born in Vienna and a sentence from Luxembourg. In the UK it is lawful if the price, the equivalence of the two versions and the fairness of the choice hold up. Whichever door you choose, your no has to be easy to give, easy to keep and respected once given.

Frequently asked questions

Do I have to accept cookies?

No. Cookies that are strictly necessary for the site to work need no consent, and in the UK some analytics cookies can be set as long as you are told and can object. Advertising cookies need your consent. What a site can do is offer a paid version if you refuse.

What happens if I reject cookies?

On most sites you carry on reading, with adverts that are not based on your profile. Some news sites show a cookie wall asking you to accept or subscribe. Either way, once you have said no, the site must not set the cookies you refused.

Why do I have to pay to reject cookies?

Because personalised advertising earns publishers more, and readers who refuse tracking bring in less. "Consent or pay", or "pay or accept cookies" as many sites put it, lets you fund the site with your data or with a subscription. The ICO accepts it if the price and the paid version are fair.

Is "consent or pay" legal in the UK?

Yes, in principle. The ICO's January 2025 guidance allows it when there is no harmful power imbalance, the fee is appropriate, both versions offer broadly the same service and refusing is as easy as accepting. The guidance is being reviewed after the Data (Use and Access) Act 2025.

Can a site keep tracking me after I reject cookies?

No. Once you refuse, a site may only use the cookies that need no consent, such as those that keep the site working. If adverts based on your browsing keep following you after a clear "reject", report it to the ICO.

How do I withdraw cookie consent?

Open the site's cookie or privacy settings, usually linked in the footer, and switch off what you accepted. Withdrawing must be as easy as consenting. To start from scratch, clear that site's data in your browser settings too.