The cookie banner with 214 partners and a consent-or-pay wall

Consent is not valid in any of the four respects that matter.

• Active, not passive: tags firing before a click means there is no clear affirmative action (Article 4(11), Article 7; the Planet49 reasoning on pre-selected boxes).
• Specific and granular: 214 partners with a single accept-all switch does not let users choose per purpose or per recipient. EDPB Guidelines 05/2020 require granularity by purpose.
• Free: no 'Reject all' on the first layer, and a save button hidden below the fold, means refusal is harder than acceptance. The imbalance is a design choice and is treated as a dark pattern.
• Withdrawal as easy as giving (Article 7(3)): there is no visible withdrawal route at all.

The ePrivacy layer. Non-essential cookies and similar storage access need prior consent under Article 5(3) of the ePrivacy Directive as implemented in Belgium, independent of whether personal data is involved. Strictly necessary cookies are exempt, and Belgium has a narrow analytics exemption on conditions - statistical, first-party, anonymised configuration - but advertising and cross-site measurement are not covered.

Legitimate interest. It cannot replace the ePrivacy consent requirement. For processing that sits outside ePrivacy, legitimate interest is theoretically available after an Article 6(1)(f) balancing test, but for behavioural advertising the balancing is hard to win, and the right to object (Article 21) must be offered anyway. The banner's wording that partners rely on 'legitimate interests' is therefore misleading in this context.

There is no automatic answer; the factors decide it, and the scale of the choice matters.

Under Article 7(4), consent is not freely given if refusal or withdrawal has detrimental consequences, and consent must be assessed against the whole offer. EDPB Opinion 08/2024 on pay-or-okay draws the line: for large platforms, a binary choice between consent and a fee is generally not valid, because the platform's market position makes consent practically unavoidable; a third, less intrusive alternative with no behavioural advertising should be offered.

For a smaller trader the assessment is case-by-case, on factors a candidate should be able to apply:

• Is the fee proportionate, or set so high that it functions as a penalty? EUR 1.99 against an average order value is modest, which helps.
• Is there a genuinely equivalent, ad-light or contextual-advertising alternative?
• Is the choice presented neutrally, without pre-selected options or guilt-inducing copy?
• Is the service one people can realistically decline - is the shop one of many, or effectively essential to the individual?
• Are the two paths' consequences explained at the point of choice?

A defensible design gives three options of comparable prominence: consent to personalised advertising, a contextual-advertising version, and a paid ad-free tier. The wall must not be used to collect consent for the 214 partners in one click.

Separately, the DPO conflict is a governance problem: an external lawyer who drafts marketing emails cannot independently monitor that same marketing under Article 38(6).

Checkout. A pre-ticked box is not consent (Article 7, Recital 32). The box must be empty, separate from terms and conditions, and never a condition of sale. Under ePrivacy Article 13, unsolicited electronic marketing needs prior consent unless the soft opt-in applies - an existing customer, in the context of a sale, given a simple opt-out at collection and in every message. Since this box is pre-ticked, even the soft opt-in is mishandled: the customer has been given no chance to refuse.

Withdrawal. Article 7(3) requires withdrawal to be as easy as giving consent. Practically that means:

• A persistent 'cookie settings' link on every page, and a withdrawal control reachable in no more clicks than the accept button.
• Withdrawal taking effect immediately, with tags removed on the next page load; a graceful degradation path so the site still works.
• A one-click unsubscribe in every marketing email, honoured promptly, with a suppression list to prevent accidental re-contact.
• Consent records: timestamp, banner version, choices made, and the interface shown (Article 7(1)). The current 3% acceptance rate is itself evidence that the banner was not working - it is not a reason to push harder.

Sequence. Fix the tag firing and add reject-all first (highest risk), then rebuild preference granularity by purpose and vendor, then the checkout box, then logs. Retain the DPO's advice in writing, including any disagreement with the marketing plan.