A website forces me to accept all cookies. Is this lawful?

What the Law Says

UK law prohibits websites from making access to services conditional on accepting non-essential cookies. Consent must meet strict legal standards under both the Privacy and Electronic Communications Regulations (PECR) and the UK GDPR.

Under the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), websites must obtain your consent before storing or accessing information on your device — unless the cookies are strictly necessary for delivering a service you’ve explicitly requested (e.g., remembering items in a shopping basket).

The UK GDPR (retained EU Regulation 2016/679) further defines valid consent: it must be 'freely given, specific, informed and unambiguous', and cannot be inferred from silence, pre-ticked boxes, or inactivity. Forcing users to accept all cookies to access content violates the 'freely given' requirement — this is known as 'cookie wall' practice.

The Information Commissioner’s Office (ICO) has confirmed that 'a blanket approach where users are required to accept all cookies or none is unlikely to represent valid consent'.

Statutory Text

A person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

— Privacy and Electronic Communications (EC Directive) Regulations 2003, reg. 6(1) — Requirement to obtain consent

Statutory Text

Consent must be freely given, specific, informed and unambiguous… Consent should not be bundled with terms and conditions, nor should it be a precondition of signing up to a service unless necessary.

— UK GDPR, Article 4(11) & Recital 42 — Definition of consent

What Courts Have Said

While UK courts have not yet issued binding judgments on cookie walls, the Upper Tribunal and domestic regulators have aligned with EU case law interpreting equivalent rules.

What to Do

Sources