Cookie wall UK: content held back until you accept

The rule

There is no separate provision on cookie walls. The rule on walls comes from the quality the law demands of consent. The ICO’s guidance explains that PECR takes its meaning of consent from the UK GDPR, so consent must be “freely given, specific, informed and unambiguous”, and that visitors must be able to refuse non-exempt technologies as easily as they accept them.

That wording leaves room. It says “in most cases”, and it says that whether a model produces valid consent “depends on what model the online service uses and the specific choices it makes about the implementation”. The same page notes that the use of storage and access technologies for advertising is not necessary to provide a service, because the service “can be provided without any advertising”.

That guidance is issued under the UK GDPR and also refers to PECR regulation 6. The ICO’s page now carries a notice that, because of changes made by the 2025 Act, the guidance “is under review and may be subject to change”. The ICO’s 2025 online tracking strategy said it would engage with publishers adopting these models and “take action where these models are introduced in ways that don’t allow for meaningful control”.

The Court of Appeal addressed what makes consent freely given in its judgment in RTM v Bonne Terre Limited ([2026] EWCA Civ 488, 21 April 2026), a civil claim over cookies and marketing. The court held that the test of consent is objective, and said at paragraph 65 that “data controllers are responsible for offering data subjects a choice that is not deceptive and which can be exercised freely without compulsion, oppression, or pressure arising from the nature of the relationship between them.” It allowed the appeal and sent the case back to the High Court. The judgment concerns the legal test, not cookie walls as such.

The ICO also says consent must be separate from terms and conditions, so “by entering you agree” does not do the job. Penalties for infringing regulation 6 are the same as in UK-01: up to £17.5 million or 4% of worldwide annual turnover for an undertaking, whichever is higher, for acts since 5 February 2026.

What PeekWell checks and how

UK-03 asks one question: can a visitor read the page without accepting tracking? The scan answers it from what the page does when nobody has made a choice.

The scan is automated. It opens your public pages the way a first-time visitor’s browser would, with no choice saved, and never clicks Accept to get in. It looks for content blocked behind the banner: an overlay that covers the page, content that’s hidden until a yes, or a banner with no way forward except accept. If the content stays blocked until someone accepts, that’s a finding. A banner that sits on the page without blocking it isn’t a wall. UK-02 covers whether refusing is as easy as accepting, which is a separate question.

The scan has limits, and the report says so. It sees the public pages it visited, and the members area when you give it a sign-in. It doesn’t port-scan, try to get in where it isn’t allowed, run any security test or open addresses nobody linked to. Some pages hold content back for other reasons, such as age checks, and the scan reports what it saw, not why. It can’t judge a consent or pay offer. Whether a fee is appropriate and the two options are equivalent are the ICO’s own factors, and they depend on markets and prices a page visit doesn’t show. A Passed means the expected behaviour was observed on the pages scanned. It doesn’t say the site complies.

Why it matters for a company

We found no published ICO penalty or reprimand aimed at a cookie wall as of 9 October 2026. The cases listed are an ICO letter to a news publisher in 2018, the ICO’s 2025 engagement with Meta, an ICO decision on marketing consent tied to accepting a website’s terms, and related decisions from EU bodies. The ICO’s position is found mostly in its guidance, its strategy and its sweeps, and a company reads that as the line the regulator has drawn in advance.

Three things follow. First, the ICO has said which model it regards as the problem: a wall that bars all access unless the visitor accepts. That can be seen from outside, and the ICO’s sweep of the 1,000 most-visited UK websites, reported on 4 December 2025, shows it tests banners from outside. Second, the paid-alternative route is open but conditional, and the conditions were still being reviewed in October 2026, so a business using it carries the burden of showing its assessment. The ICO asks for that assessment to be documented in the data protection impact assessment. Third, consent that is bundled is weak consent, and the weakness spreads: if consent is not freely given, the cookies set on the strength of it were set without valid consent, which is the situation described in UK-01.

A wall is often added to protect advertising income. The ICO recognises that businesses may want to fund services this way, but says the funding model has to leave a genuine choice.

Smaller companies and larger companies

The rule has no size threshold. The ICO’s consent or pay case studies are illustrations, not statements about any type of organisation, and describe each organisation carrying out its assessment “in a way which reflects the nature and size of the organisation”.

In a smaller company a wall is usually an accident of settings: a banner plugin’s “block content until accepted” switch, or a theme overlay with no button except Accept. There is no published ICO decision on a cookie wall against a smaller company, so the risk here is mostly one of complaint or a letter, as with other banner faults.

In a larger company a wall is more often a decision. A publisher or media business weighs advertising income against readers and adopts a consent or pay model. The ICO’s case studies show how it would approach two examples: a social network with strong network effects, where a plain consent or pay offer would risk a power imbalance and a free contextual-ads option helps, and a news site, which concludes that its first offer does not meet the fee factor and adds a standard subscription.

How to fix it

1. Look at the page the way a stranger sees it. Open a private window, do not touch the banner, and try to read the page. If the content is covered, hidden or does not load, you have a wall.
2. Turn off “block until accepted” in your consent tool. Many banner tools have a setting that locks the page behind the banner. Switch it off, or restrict it to the one choice screen you really need.
3. Offer a refusal that opens the page. Put a Reject button next to Accept, so that refusing leads to the same content. UK-02 covers the buttons’ weight.
4. Keep the page working without the optional cookies. Make sure refusing does not break the content, and that the optional tags stay off until accepted, as in UK-01.
5. If you rely on consent or pay, write the assessment down. Cover power imbalance, the fee, equivalence of the options and how you present them, and consider a free option with contextual ads. Take legal advice, because the ICO’s guidance is under review.
6. Re-scan. Clear cookies and storage, reload, and run a scan again. The finding should disappear once the content opens without an accept.

Whether a particular model gives valid consent is a question for your legal adviser. Peeky reports only what it sees.