Legal Q&A · IT, Software & E-commerce

Is an accept-or-leave cookie banner lawful?

Law as at 5 September 2026

Answered by , Czech and Slovak attorney, admitted to the Slovak and Czech Bars (SAK 300422 · ČAK 19654).

Short answer

No. Cookie consent must satisfy the GDPR and be freely given; accept or leave is not a real choice. The European Data Protection Board's consent guidelines expressly state that access to content must not depend on cookie consent. A banner therefore needs an equally prominent reject button on its first layer, and the website must work after rejection. The paid alternative, pay or consent, remains disputed.

A visitor opens a website and sees a full-screen banner with a single “Accept all” button. There is no close button, rejection is hidden and content is locked. This cookie wall is convenient for the operator: consent rates approach one hundred percent. Legally, however, valid consent was never given.

In Slovakia, storing and accessing cookies is governed by the Electronic Communications Act:

Anyone storing or accessing information stored on a user’s terminal equipment may do so only if the user has given demonstrable consent meeting the requirements of a separate regulation […] This does not prevent technical storage or access whose sole purpose is transmitting or facilitating transmission of a communication over a network, or where strictly necessary for an information society service provider to provide a service expressly requested by the user.

— Section 109(8) of Act No. 452/2021 Coll. (unofficial English translation)

The separate regulation is the GDPR. Under Article 4(11), consent must be freely given, specific, informed and unambiguous. Only technically necessary cookies can operate without consent: those transmitting a communication or needed for a service the user expressly requested, such as an online shopping basket. Analytics and marketing do not fall within this exception.

Freely given consent requires a real opportunity to refuse without adverse consequences. Article 7(4) GDPR requires consideration of whether a service is conditional on consent unnecessary for that service. Losing access to the entire website is precisely such a consequence. In Guidelines 05/2020 on consent, the European Data Protection Board expressly concludes that access to services and functions must not depend on consent to storing information on a user’s device. Its example of invalid consent is a script blocking content until the visitor clicks “Allow cookies”.

The practical consequence is that consents collected through a cookie wall are invalid. Marketing and analytics cookies therefore operate without a legal basis, with the associated risks before the Office for Personal Data Protection.

The variant allowing a visitor to buy ad-free access instead of consenting is not definitively resolved. In Opinion 08/2024 on consent-or-pay models used by large online platforms, the European Data Protection Board stated that a binary choice between consent and a fee will generally not establish valid consent, and platforms should consider a free alternative without tracking. The opinion does not directly cover smaller websites, but indicates the direction of supervisory thinking. Anyone adopting this model should obtain an assessment rather than simply copy it.

What a compliant banner looks like

Rejecting must be as easy as accepting: a “Reject” button on the first layer, as visible as “Accept”. There should be no pre-ticked boxes, choices must be separated by purpose, content must remain accessible after rejection, and withdrawing consent must be as easy as giving it. Technically, measurement or marketing scripts may run only after consent is clicked, not when the page loads. We summarise other website data requirements in personal data processing duties and explain why the GDPR also covers websites without forms in websites without names and the GDPR.

How we can help

We examine what your website actually stores and configure the banner and wording for valid consent through our cookies and website configuration service. Our GDPR and personal data protection service covers broader data compliance, while online shops can use our complete legal services for e-commerce. Send us the website address: we can usually identify necessary changes on first inspection.

This answer provides general information on the law as at 5 September 2026. It does not constitute legal services or replace an assessment of an individual case. The details of your situation may differ. Book a consultation to discuss them.

More legal questions

All questions and answers
  1. We are planning a purchase-linked consumer competition. Do we need a licence, and who pays tax on prizes? No licence is needed. A purchase-linked competition is a promotional competition expressly excluded by gambling law, provided it promotes sales, is not a separate business and requires no stake; payment for goods is not a stake. The rules are a consumer contract with corresponding requirements. For tax, the organiser withholds tax on cash prizes; winners declare non-cash prizes, while prizes within the statutory limit are exempt. Czech promotional competitions without a stake likewise require no licence.
  2. Can we send newsletters to existing customers without their express consent? Yes, for existing customers, subject to the statutory exception. The Electronic Communications Act requires prior demonstrable consent for email marketing. Consent is unnecessary when promoting your own similar goods or services to people whose address you obtained during a sale, provided they can refuse easily and free of charge both when you collect it and in every message. Bought or borrowed databases do not qualify. You also need a GDPR legal basis, usually legitimate interests, with a right to object at any time.
  3. Must an influencer label our post as advertising, and who is liable if they do not? Yes. A paid or otherwise rewarded post is advertising and a trader's commercial practice. If its promotional nature is unclear, the Consumer Protection Act treats it as an always-prohibited unfair commercial practice. The trader whose product is promoted bears primary responsibility, but the law expressly also covers anyone acting in its name or on its behalf, including the influencer. Labels must be understandable and visible without expanding the post. The contract should expressly regulate labelling, content approval and sanctions.
  4. What must appear on a company website even if we do not sell through it? Generally, these duties apply. A company website is an information society service even without sales if it promotes the business. The Electronic Commerce Act requires the business name and registered office, email and phone, register and entry number, tax identification number if VAT-registered, and the supervisory authority's name and address. The Commercial Code adds the company identification number and legal form. Details must be easily and permanently accessible, not supplied only on request. GDPR transparency and cookie rules also apply.

Cannot find your question? Ask your own question

Facing this situation?

Tell us what you need help with.

Describe your situation. We will review it and tell you within 24 hours whether and how we can help, including an indicative fee.

  1. 1Send your enquiry via this form
  2. 2Within 24 h you get a price confirmation and plan
  3. 3We start work only after your approval
Mgr. Patrik Tulinský, LL.M. Czech and Slovak attorney · SAK 300422 · ČAK 19654

Not keen on calls or email? Message us on WhatsApp →
Prefer to book a time right away? Book a consultation →
Or email us about this matter.

PDF, Word, images, ZIP… max 10 MB per file, 30 MB total.

Submitting this form does not create an engagement or attorney-client relationship. Before taking on a matter we run a conflict-of-interest check, so please do not send sensitive originals until we confirm the matter together.

Contact a lawyer