Consent or Pay in the EU: a timeline

Consent or Pay, soon in theatres: a timeline from 2016 to Q2 2025 charting the positions of Meta (consent or go, contract, legitimate interest, consent or pay, consent-pay-or-wait), publishers (we take that as a yes, accept or settings, consent or pay), EDPB and supervisory authorities (EDPB cookie banner task force, DPC/EDPB 390M Meta fine, Norway on legitimate interest, AEPD on pay-for-news, EDPB opinion on large online platforms, ICO consent-or-pay guidance), the CJEU (Bundeskartellamt ruling), EU law (GDPR redefining consent, DMA consent requirement for gatekeepers) and the EU Commission (DMA 200M Meta fine). — Source: own. To be used as a reference in recent Masters of Privacy episodes covering the topic.

The timeline in text

A transcription of the chart above, row by row, in the chart’s own words. Periods are those shown on the chart’s axis: 2016, 2018, Q2 2023, Q4 2023, Q1 2024, Q4 2024 and Q2 2025.

Meta.

2016: consent or go.
2018: contract.
Q2 2023: legitimate interest.
Q4 2023: consent or pay.
Q4 2024 to Q2 2025: consent, pay or wait.

Publishers.

2016: “we take that as a yes”.
2018: accept or settings.
Q1 2024: consent or pay.

EDPB and supervisory authorities.

January 2023: the EDPB cookie banner task force; DPC and EDPB, 390M against Meta.
July 2023: Norway, legitimate interest not OK for Meta.
January 2024: AEPD, consent or pay is OK for news.
April 2024: EDPB, consent or pay not OK for large online platforms.
March 2025: ICO, consent-or-pay guide.

CJEU.

Q2 2023: Bundeskartellamt, consent or pay OK.

EU law.

2016: the GDPR, consent redefined.
Q2 2023: the DMA, consent required for gatekeepers.

EU Commission.

April 2025: DMA, 200M against Meta.