Not a vulnerabilityNothing is broken. The wall is the product decision, stated openly, and the objection is to the choice it leaves.
What it is
Before any content is shown, the visitor is offered two ways forward: pay for a subscription, or accept processing for advertising and measurement by third parties. There is no third path. A refusal exists on paper, and that is what the payment is for, but exercising it costs money and the price is set by the party asking for the consent.
Why it is a separate entry
Consent has to be free, and here it is weighed against access to information. The people for whom the price is real are the ones with the least room to refuse, so the arrangement buys consent from those who can least afford to withhold it. And the choice returns on every site, which no household budget survives.
How it arises
a subscription introduced as the alternative that is supposed to make the consent free
an advertising operation that cannot run without the third-party purposes, so no third path is designed
a price set at the level of a full subscription rather than at the value of the advertising it replaces
the paid tier keeping some of the same purposes, which is only visible in a capture
Not to be confused with
A banner with no refusal control at all is No refusal option: here a refusal exists and it has a price. A refusal that changes nothing in the traffic is Refusal without effect: here the refusal works, and the question is whether it was free.
How to establish it
On the first screen the paths that reach the content are exactly two: one that registers a positive consent state for third-party purposes, and one that requires payment. No control reaches the content with a negative consent state registered. Establish it by taking every path from a clean profile and recording the resulting state.
method differentialQoD 90
Requirements on the measurement
clean profile, no interaction before the wall appears
walk every layer reachable from the first screen, including screens behind a link or a small control
record the price, and which purposes the paid path still permits; a paid tier that keeps third-party purposes is part of the finding
record the country the capture egressed from, because the wall is often shown to some regions only
What would refute it
by handA third path exists that reaches the content with a refusal registered, however unattractive it is made.finding falls
by handThe wall covers part of the offering while the rest is reachable without either choice.weakens
automatedThe accepting path registers a refusal for third-party purposes and permits only the operator's own.The choice is then between paying and being measured by the operator itself, which is a narrower question than this entry.reclassify
by handThe paid path is free of the third-party purposes and the price is stated before the choice is made.This does not dispose of the freedom question, but it removes the compounding one, where paying buys nothing.weakens
Where this plugs into existing processes
The one question that surfaces itShow me the way to your article for someone who refuses and does not pay.
In a DPIA, verify this
Verify how many paths reach the content and which consent state each one registers, rather than the statement that visitors have a choice.
As a procurement clause
A path exists to the content with third-party purposes refused, without payment, and it is reachable from the first screen.
With a complaint, hand over
A capture of the first screen, every path taken separately with the consent state that followed, and the price of the paid path.
Reproduction
METHOD.md · by hand · no dedicated reproduction exists yet; follow the general method and the indicator above
Legal framing
eu-gdpr-7-4
eu-gdpr-6-1-a
nl-tw-11-7a
Objections, and the answer
“Nobody is forced; there is a paid alternative.”
That is the point at issue. Refusing then costs money, and consent has to be free of exactly that weighing.
“Journalism has to be paid for.”
It does, and a subscription is a lawful way to do it. What is at issue is the pairing: the price is set against the consent rather than against the advertising revenue the consent produces.
“Supervisory authorities have accepted this model.”
Positions differ per authority and are moving. Cite the position of the authority competent for the party, with its date. The measurement is the same whatever that position becomes.
“The paid tier has no advertising.”
Testable in a capture of the paid path. Where third-party purposes persist behind the payment, the two options collapse into one.
What this does not establish
harm; the catalogue standardises a finding so it can be referred to, it does not weigh it
severity; there is no score here, by design. Weighing belongs to whoever applies the entry to a concrete case
unlawfulness; that is for a supervisory authority or a court
intent; a fault is usually a build decision, not a plan
absence: not finding it in one capture is not evidence that it is not there
DPE Catalogue. DPE-2026-0040: Pay or accept as the only choice. Schema 2.0, entry status active. Retrieved from https://totaledigitalewaarborging.nl/register/DPE-2026-0040
Measurement
When you publish a finding, cite the method version alongside the entry: “DPE-2026-0040, established under DPE Measurement Method 1.0”
Identifiers are permanent and are never
reused. An entry that is deprecated keeps its number and its address, with the reason attached, because
references to it exist elsewhere.