Privacy Gate DPG Media: no valid consent yet

You must be able to demonstrate that each choice your visitors make is free, specific, informed and reversible, and that a genuine alternative exists without behavioural advertising. An interface that displays those choices is not itself proof that these conditions have been met.

The prompt is an analysis of 27 September 2026 of consent-or-pay models and the validity of consent mechanisms, which argues that a data-choice interface alone cannot satisfy regulatory requirements for valid consent. The case in point is a publisher's Privacy Gate mechanism, which centralises visitor data choices in a single interface. In our assessment, this reflects a broader governance pattern among digital publishers: replacing fragmented consent choices with a visible layer. That can improve transparency and usability. The critical gap is that visibility of a choice mechanism says nothing about whether the choice itself is legally valid.

What makes consent valid under data protection law?

The Autoriteit Persoonsgegevens sets out four conditions that must hold before consent can be considered valid. Each is testable. The organisation must be able to demonstrate that consent was obtained. An interface that displays options does not automatically prove these conditions have been satisfied.

• Absence of coercion — the choice must be genuinely free, not forced by design or circumstance.
• Specificity — consent must apply to a defined purpose, not a blanket grant.
• Informed decision-making — the visitor must understand what they are consenting to before they choose.
• Revocability — the visitor must be able to withdraw consent as easily as they gave it.
• Genuine alternatives — a real option must exist that does not require behavioural advertising or payment for an equivalent service.

What does the EDPB say about consent-or-pay?

In Opinion 08/2024, the European Data Protection Board examined consent-or-pay models used by large online platforms. It concluded that in most cases, such models do not produce valid consent. The Board emphasised that where payment is required for an alternative service, an additional free alternative should be considered—for instance, advertising with minimal or no personal data processing. The Board's position is that alternatives must be genuinely equivalent, not merely available.

The open question is whether your Privacy Gate or similar mechanism offers such an alternative. Your own documentation may describe the transparency purpose, but it must also demonstrate that the choice is free. Visibility is not freedom.

Which concrete controls must you be able to demonstrate?

The EDPB's work programme on consent-or-pay is still developing. That means you should treat your data-choice interface not as a completed compliance measure, but as one element in a broader accountability system. You must retain evidence of your own design choices.

1. Document the data-processing purpose for each workflow — record which personal data each choice activates, and the lawful basis for processing it.
2. Map each choice to its underlying service — show which advertising or analytics systems are triggered by each visitor selection.
3. Record the alternative pathways available — document what service or content the visitor receives if they refuse behavioural advertising, and whether that alternative is equivalent.
4. Log consent events with timestamps and revocation capability — maintain records showing when consent was given, what it covered, and when it was withdrawn.
5. Retain design documentation for the interface itself — keep records of how choices are presented, in what order, and what information is displayed before the visitor decides.

What role can tooling play in this?

A Privacy Gate or similar interface can be a useful governance control. It can centralise choices and make them visible. It cannot, on its own, be conclusive proof that consent is valid. Its value depends entirely on whether the choices you offer are truly free, granular, informed and reversible, and on whether you can demonstrate which data-processing purposes and underlying services each choice sets in motion.

As long as the EDPB is working on broader guidelines, the prudent approach is to document design choices, purposes, alternatives and consent flows in detail. Do not treat the interface as an endpoint. The interface is one layer; your accountability system is another. Tooling can help you log and track consent events, but it cannot replace your own professional judgment about whether the choice you are offering is genuinely free.