European UnionA website requires me to accept all cookies to use it. Is this valid consent under EU law?
No, requiring users to accept all cookies to access a website is not valid consent under EU law because consent must be freely given, specific, informed, and unambiguous.
What the Law Says
EU law sets strict conditions for valid cookie consent. The General Data Protection Regulation (GDPR) defines consent, while the ePrivacy Directive (ePD) specifically governs electronic communications and cookie use.
Under the GDPR, consent must be 'any freely given, specific, informed and unambiguous indication of the data subject's wishes' — meaning users must have real choice and control.
The ePrivacy Directive requires that storing or accessing information on a user’s device is only allowed 'if the subscriber or user has given his or her consent, having been provided with clear and comprehensive information'.
Crucially, consent cannot be bundled: users must be able to refuse non-essential cookies without losing access to core services.
Statutory Textconsent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes
— Regulation (EU) 2016/679, Art. 4(11) — Definition of consent
Statutory Textthe storing of information, or the gaining of access to information already stored, in the terminal equipment of a subscriber or user is only allowed on condition that the subscriber or user has given his or her consent
— Directive 2002/58/EC, Art. 5(3) — Cookie consent rule
What Courts Have Said
The Court of Justice of the European Union (CJEU) has ruled decisively that forced consent violates EU law.
The CJEU held that pre-ticked checkboxes do not constitute valid consent, and that users must actively opt in — not be forced to accept all cookies to access a service.
What to Do
Reject websites that block access unless you accept all cookies — this is unlawful under EU law.
Use browser settings or privacy tools to block non-essential cookies by default.
Report non-compliant sites to your national data protection authority (e.g., CNIL in France, ICO in the UK pre-Brexit, or DPA in your member state).
Look for granular cookie controls: legitimate sites offer separate toggles for analytics, advertising, and functional cookies.
Sources
Same Question, Other Jurisdictions
Germany
Ireland
UK
South Korea
JapanNot legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-06-08.