News publishers need opt-in consent from European readers before any advertising or analytics cookie is set, and a cookie wall with no alternative is unlikely to produce valid consent. A pay or consent model, where readers can subscribe instead of accepting tracking, can work if the price is reasonable and both choices are presented fairly. For programmatic ads, Google also expects a certified CMP integrated with the IAB TCF.
The publisher's privacy dilemma
News publishers sit between reader privacy and advertising revenue. Programmatic advertising, the financial engine behind most online journalism, relies on cookies and tracking technologies that fall squarely under the ePrivacy Directive and the GDPR.
Without valid consent, publishers cannot serve personalised ads through real-time bidding, and non-personalised ads usually earn less. That pressure has pushed many publishers to try cookie walls and pay or consent models, which regulators across Europe look at closely. Knowing where the legal lines sit matters for any publisher that earns money from advertising or subscriptions.
A cookie wall and pay or consent are not the same thing
A cookie wall blocks access to content unless a visitor accepts all cookies. There is no alternative: no paid option, no reduced version. The visitor either consents to tracking or leaves.
A pay or consent model offers a choice: accept cookies and read for free, or pay a subscription for access without tracking. Regulators treat the two approaches very differently.
The European Data Protection Board adopted Opinion 08/2024 on 17 April 2024. It concluded that large online platforms offering only a binary choice between consenting to behavioural advertising and paying a fee will, in most cases, fail the GDPR's standard for freely given consent. The opinion is limited to large online platforms such as Meta, not news publishers.
National authorities have published criteria for publishers. The CNIL, France's data protection authority, set out its first assessment criteria for cookie walls on 16 May 2022, accepting a paid alternative under conditions. The ICO has guidance on consent or pay, which it describes as under review after the Data (Use and Access) Act.
Conditions for a lawful pay or consent model
The CNIL's criteria, and the questions the ICO's guidance asks, point to a common set of conditions:
- The paid alternative is real and fair: it gives equivalent access to the content, not a degraded experience
- The price is reasonable and does not deprive readers of a genuine choice
- Both options are presented in a balanced way, without dark patterns that steer readers towards accepting cookies
- Consent stays specific, informed and easy to withdraw at any time
- The wall covers only the purposes that fund the service: refusing, say, content personalisation should not block access if advertising pays for the site
The CNIL does not set a price threshold, but says the publisher must be able to justify that its price is reasonable, and encourages publishing that analysis. A publisher without that documentation will struggle to defend its model if a regulator asks.
Cookie walls without an alternative rarely give valid consent
Pure cookie walls, where no alternative exists, face a much harder legal path. The EDPB's Guidelines 05/2020 on consent say access to services should not be made conditional on consent to processing that is not necessary for that service. Article 7(4) of the GDPR reinforces this: when assessing whether consent is freely given, utmost account shall be taken of whether the performance of a contract is conditional on consent to processing not necessary for that contract.
For publishers, the test is simple to state. Reading a news article does not need tracking cookies: the article loads fine without _fbp or _ga. The tracking serves the publisher's advertising model, not the reader's access to content.
A pure cookie wall with no alternative to accepting tracking is unlikely to produce valid consent under Article 7 GDPR. Pay or consent exists to fill that gap with a genuine alternative.
IAB TCF is the consent plumbing behind programmatic ads
The IAB Transparency and Consent Framework (TCF) is the consent protocol that underpins programmatic advertising in Europe. IAB Europe released version 2.3 on 19 June 2025, and the transition ended on 28 February 2026. Since 1 March 2026, TC strings created under 2.3 without the disclosed-vendors segment are invalid.
For publishers, the TCF directly affects revenue. Google requires a Google-certified CMP integrated with the TCF for personalised ads on AdSense, Ad Manager and AdMob: for EEA and UK traffic since 16 January 2024, and for Swiss traffic since 31 July 2024. Without one, Google says traffic is not eligible for personalised ads but may still get non-personalised or limited ads.
| Situation | What Google can serve | TC string |
|---|---|---|
| Consent to personalised ads | Personalised ads | Valid TC string with the needed purposes |
| Consent without personalisation | Non-personalised ads | Valid TC string with restricted purposes |
| No consent to storage on the device | Limited ads, without local identifiers except invalid-traffic cookies | Valid TC string recording the refusal |
| No certified CMP | Non-personalised or limited ads where supported | None from a certified CMP |
A full rejection therefore does not mean no ads. It means ads that earn less, which is why the consent rate matters so much to publishers.
TCF v2.3 made disclosure of every vendor in the TC string mandatory, so a vendor can tell whether it was shown to the reader. Publishers running header bidding with dozens of demand partners should audit their vendor lists: each vendor must be disclosed to the reader and have its legal basis recorded in the string.
Publishers share responsibility under the TCF
Under the TCF, the publisher is a controller for collecting consent on its site, and it shares responsibility with the vendors it lists. The Court of Justice ruled in IAB Europe (C-604/22) on 7 March 2024 that a TC string is personal data when it can be linked to an identifier such as an IP address, and that IAB Europe can be a joint controller. If a vendor in your TCF configuration processes a reader's data without valid consent, you face regulatory exposure too.
A certified CMP that supports TCF v2.3 is the baseline. Beyond that, review which vendors appear in your consent interface and remove those no longer active in your ad stack.
Consent rates decide the revenue
Consent rates vary by industry, and news sites face particular pressure. Privacy-conscious readers, ad blockers and banner fatigue all push opt-in rates down, and mobile banners interrupt reading more than desktop ones.
The temptation to use manipulative banner designs is real: hiding the reject button, using confusing toggles or adding friction to refusal. Regulators have made their position clear. On 1 September 2025 the CNIL fined Google €325 million, over ads inserted between Gmail emails and advertising cookies at account creation without valid consent, and Shein €150 million for advertising cookies set before any choice. Pre-ticked boxes, unequal buttons and other dark patterns remain enforcement priorities for European authorities.
Google Consent Mode v2 for publishers
Beyond the TCF, publishers using Google products need Google Consent Mode v2. Google has enforced it since March 2024 for users in the European Economic Area, the UK and Switzerland, the users covered by its EU user consent policy, for publishers running Google Ads, AdSense or GA4.
Consent Mode v2 added two parameters, ad_user_data and ad_personalization, which must reflect the reader's actual choice. When consent is denied, Google can use conversion modelling to estimate the data it cannot collect. For publishers, analytics and attribution data then contain modelled figures rather than observed data for part of the traffic.
The practical challenge is keeping TCF consent strings and Consent Mode signals in step. A mismatch, where the TC string grants consent but Consent Mode signals denial or the other way round, causes either compliance problems or needless revenue loss.
Protecting reader trust while keeping revenue
Reader trust is a publisher's most valuable long-term asset. A banner that feels deceptive, one that buries the reject option or uses guilt-tripping language, erodes that trust even if it produces a consent signal.
Transparent consent design helps publishers too. Readers who feel respected are more likely to return and to subscribe. A clear banner that explains why advertising funds journalism treats readers as adults.
Practical steps for keeping trust:
- Use plain language in banner copy, and explain that advertising funds the journalism readers access for free
- Give "Accept all" and "Reject all" equal prominence on the first layer
- If you run pay or consent, show the subscription price clearly next to the free option
- Run regular cookie audits so no undisclosed tracker fires before consent
- Offer a preferences modal where readers can change their choice without hunting for a hidden link
Questions publishers ask about consent
Does the EDPB ban pay or consent for publishers?
No. EDPB Opinion 08/2024 addressed large online platforms, not news publishers. The CNIL has published criteria under which a paid alternative can be acceptable, and the ICO has guidance on consent or pay, which it says is under review.
What happens to ad revenue if visitors reject cookies?
Ads do not stop, but they earn less. Google can serve limited ads, which use no local identifiers except invalid-traffic cookies, to readers who refuse storage on their device. How much less they earn varies by market and inventory, and there is no single published figure.
Do publishers need IAB TCF to serve ads in Europe?
For personalised Google ads, yes. Google requires a certified CMP integrated with the TCF for AdSense, Ad Manager and AdMob traffic from the EEA and the UK since 16 January 2024, and from Switzerland since 31 July 2024. Without one, traffic can still get non-personalised or limited ads where supported.
How much should a pay or consent subscription cost?
There is no fixed threshold. The CNIL says the publisher must be able to justify that its price is reasonable, and a price so high that no reasonable reader would choose it may be seen as forcing consent rather than offering a genuine alternative.
Can publishers use legitimate interest instead of consent for ad cookies?
No. For cookies and similar technologies, Article 5(3) of the ePrivacy Directive requires consent whatever the GDPR legal basis for later processing. Legitimate interest cannot replace consent before non-essential cookies are placed on a reader's device.
Check what your TC string actually records
If you run a TCF CMP, the string it writes is the evidence vendors rely on. Paste one into Kukie.io's TCF string decoder to see which purposes, vendors and legal bases it grants, and compare it with what your banner showed the reader.
