Consent or pay is a model where a website or app gives people two ways in: agree to their personal data being used for personalised advertising, or pay a fee to use the service without that tracking. It is sometimes called “pay or OK”, and in the UK it is judged against the consent rules in UK GDPR and PECR.
How consent or pay works
Under PECR, a site needs consent before setting cookies or similar tracking that is not strictly necessary, and UK GDPR says consent only counts when it is freely given. The question consent or pay raises is whether a choice between “accept tracking” and “pay money” is a free one.
The ICO published guidance on this in January 2025. Its position is that consent or pay can be lawful, but it has to be assessed case by case, and it sets out four factors to weigh:
- Power balance. If people have no realistic alternative to your service, for example because it dominates its market or they need it to do their job, their consent is less likely to be free.
- Equivalence. The paid option should be broadly the same service, minus the personalised ads, not a stripped-down version.
- Appropriate fee. The price should not be set so high that paying is not a real option.
- Privacy by design. Both choices should be presented clearly and with equal weight, and people must be able to change their mind and withdraw consent easily.
This is different from a cookie wall, where the only options are accept tracking or leave. The best-known UK example came in late 2025, when Meta began offering adults in the UK a paid subscription to use Facebook and Instagram without ads, while the free version moved to asking for consent to personalised advertising. The ICO welcomed the change.
Why it matters for a UK business
For most businesses I work with, consent or pay is not a realistic model. Nobody pays to read a dentist’s treatment page or a roofer’s quote form, and blocking those pages until someone accepts tracking would lose enquiries and would probably fail the “freely given” test anyway. The model is built for publishers and apps funded by advertising, where content is the product.
It still affects you as an advertiser. Every person who pays for an ad-free version, or declines personalised ads, drops out of the audiences you can target and the conversion data you get back. On Meta that can mean smaller retargeting pools and fewer matched conversions, which is part of why consent-driven data loss is now a normal planning assumption rather than an edge case.
Common mistakes
- Treating consent or pay as a way round the cookie rules rather than a model that must pass the ICO’s tests.
- Setting a fee designed to push people into accepting tracking.
- Making the paid version worse than the free one in ways unrelated to advertising.
- Showing “accept” prominently and hiding the paid or reject route.
- Offering no easy way to withdraw consent once given.
- Relying on decisions from EU regulators without checking the ICO’s own guidance, which is what applies to UK users.
How to act on it
If you run an ad-funded publication or app and are considering the model, write a short assessment against each of the ICO’s four factors before launch, keep it on file and revisit it when prices or features change. Test the flow on a phone as a new visitor to check both routes are equally clear.
If you are an ordinary business website, the better route is a standard cookie banner where rejecting is as easy as accepting, with analytics and ad tags held until consent. Then plan your measurement and targeting around the fact that some people will say no. A digital marketing strategy I write for a client takes that consent rate into account when setting budgets and targets.