THE BOTTOM LINE
- “Cookie Wall” Business Model Under Threat: The Advocate General’s opinion suggests that making website access conditional on accepting tracking cookies is likely unlawful under the GDPR, as such consent is not “freely given.”
- Revenue Models at Risk: Companies relying on ad-based revenue generated through user tracking data will need to urgently re-evaluate their consent mechanisms. The “accept all or leave” approach is facing a significant legal challenge.
- Prepare for a Stricter Interpretation: While this is a non-binding opinion, the Court of Justice of the European Union (CJEU) follows the AG’s reasoning in the majority of cases. Businesses should prepare for a future where a genuine, tracker-free alternative must be offered.
THE DETAILS
In a highly anticipated opinion, the Advocate General of the CJEU has weighed in on one of the most contentious issues in digital privacy: the legality of “cookie walls.” The case, C-528/24, examines whether a business can legally block users from accessing its website or service unless they consent to the use of all cookies, including those for advertising and tracking. The central legal question is whether consent obtained under such “take-it-or-leave-it” conditions can be considered “freely given” as explicitly required by Article 7 of the GDPR. This opinion provides a clear signal that the Court may be poised to dismantle a consent model that has become widespread across the digital economy.
The Advocate General’s reasoning focuses on the fundamental imbalance of power between the data controller (the website) and the data subject (the user). The opinion argues that when a user is faced with the choice of either agreeing to be tracked or being denied access to content or services, there is no genuine choice. This constitutes a clear detriment for refusing consent, effectively coercing the user into agreement. The AG concludes that for consent to be valid, the user must be able to refuse tracking cookies without suffering negative consequences, such as being barred from the service entirely.
The commercial implications of this opinion, should the Court adopt its reasoning, are profound. It would essentially outlaw the common practice of forcing consent to data-driven advertising as a prerequisite for access. Businesses will need to innovate and adapt, potentially by offering a paid, ad-free alternative or relying more heavily on contextual advertising that does not require personal data tracking. This opinion is a critical warning for all CEOs and legal departments: the regulatory environment for data monetization is tightening, and business models built on coerced consent are standing on increasingly fragile legal ground.
SOURCE
Source: Court of Justice of the European Union
