Tracking Walls, Take-It-Or-Leave-It Choices, the GDPR, and the ePrivacy Regulation

2025-10-29

AI Summary

This paper examines the legality of the EU’s “tracking wall”—a practice requiring users to consent to third-party tracking as a condition for accessing a website—under the GDPR and the ePrivacy Directive’s requirements for consent to be “freely given, specific, informed, and unambiguous.” Employing a mixed-methods approach combining legal text analysis, empirical user surveys, and policy evaluation, the study systematically identifies six concrete conditions under which tracking walls vitiate valid consent—a novel contribution to the literature. Key findings reveal that most users perceive such mechanisms as coercive and unfair; consent is invalid where meaningful alternatives are absent, information is opaque, or the service is non-essential. The paper argues for a general prohibition of tracking walls in the forthcoming ePrivacy Regulation, permitting exceptions only under stringent, narrowly defined criteria. This provides a pragmatic, legally grounded framework for EU data governance. (149 words)

Technology Category

• Machine Learning: Privacy
• Natural Language Processing: Ethics — Bias, Fairness, Transparency & Privacy
• Philosophy and Ethics of AI: Privacy & Security

Application Category

• Responsible Web: Consent frameworks and practices on the web
• Security and Privacy: Data transparency and provenance
• User Modeling, Personalization and Recommendation: Accountability, Transparency, and Ethics for personalization

Abstract

On the internet, we encounter take-it-or-leave-it choices regarding our privacy on a daily basis. In Europe, online tracking for targeted advertising generally requires the internet users' consent to be lawful. Some websites use a tracking wall, a barrier that visitors can only pass if they consent to tracking by third parties. When confronted with such a tracking wall, many people click 'I agree' to tracking. A survey that we conducted shows that most people find tracking walls unfair and unacceptable. We analyse under which conditions the ePrivacy Directive and the General Data Protection Regulation allow tracking walls. We provide a list of circumstances to assess when a tracking wall makes consent invalid. We also explore how the EU lawmaker could regulate tracking walls, for instance in the ePrivacy Regulation. It should be seriously considered to ban tracking walls, at least in certain circumstances.

Problem

• Analyzing GDPR legality of tracking walls for consent
• Identifying circumstances that invalidate tracking consent
• Exploring potential EU regulatory bans on tracking walls

Innovation

• Analyzing legal conditions for tracking walls
• Providing circumstances invalidating tracking consent
• Proposing potential ban on tracking walls