The short answer, in three parts
Three different acts are involved, and the rules treat them differently.
Noticing your ads did not load
Where it stands: no court or regulator we found calls it unlawful in itself.
What decides it: how the check is done (the next two rows).
Storing or reading on the visitor's device to do it
Where it stands: inside the EU device rules.
What decides it: consent, unless an exemption fits your setup.
Showing a wall until the visitor allows ads
Where it stands: your decision, within consumer, accessibility and data protection law.
What decides it: how you word it; where consent is needed, France's CNIL assesses cookie walls (access in exchange for consent) case by case.
Which rules apply to adblock detection
| Rule | What it says | Status | Source |
|---|---|---|---|
| EU ePrivacy Directive, Article 5(3) | Storing or reading on the device needs consent, except for transmission or what is strictly necessary for a service the user explicitly requested. | In force through national laws | EUR-Lex |
| EU EDPB Guidelines 2/2023 | What counts as storage or access; the exemptions are left aside. | Adopted (v2.0), October 7, 2024 | EDPB |
| EU GDPR, Article 4(1) and recital 30 | Applies to personal data; IP addresses can be identifiers. | In force | EUR-Lex |
| EU Digital Omnibus, COM(2025) 837 | Would move the device rule for personal data into the GDPR (Article 88a), with a closed list of exceptions. | Proposal, not adopted | EUR-Lex |
| California CCPA, Civil Code 1798.140 | IP addresses can be personal information; aggregate information is not. | In force (text as of January 2025) | California Privacy Protection Agency |
No rule we found, in the EU or elsewhere, names adblock detection.
Does an adblock detection script access the visitor's device?
Article 5(3) is not limited to cookies or to personal data. The EDPB reads it as covering any "information" and describes three cases:
- Storage Writing to browser storage, cookies included, with no minimum duration or size.
- Access JavaScript that tells the browser to send information back "clearly falls within the scope".
- Access A result worked out in the browser and sent to a server is still access.
How the EDPB reads storage and access. Whether a given script is in scope is assessed case by case.
The guidelines leave the exemptions to a case-by-case analysis under each country's law: the rule applying "does not systematically mean that consent needs to be collected". They do not mention ad blockers.
Do you need consent? What is settled and what is still open
Settled
- Storing or reading on the device is in scope in the EU.
- The EU exemption covers only what is strictly necessary for a service the user explicitly requested.
Open
- Whether detection is strictly necessary for the service the reader asked for.
- How each national authority would treat it.
In the EU. A 2016 Commission letter to a privacy campaigner was reported in the press as saying Article 5(3) applies to detection scripts; it is not official guidance and we could not read the original. In an answer to a Member of the European Parliament on December 22, 2023, the Commission said that whether detection falls under Article 5(3) should be assessed case by case, and that enforcement is for national authorities and courts.
Disclose the script in your privacy or cookie notice and take the scope and consent questions to your adviser.
- Directive 2002/58/EC sets the device rule, Article 5(3).
- Directive 2009/136/EC rewrites it: consent, with a narrow exemption.
- Commission letter, known only from the press, reported as requiring consent.
- Court of Justice, Planet49: the rule covers any information, personal data or not.
- Commission: assess detection case by case.
- EDPB Guidelines 2/2023 final.
- Withdrawal of the 2017 ePrivacy Regulation proposal published.
- Proposal to move the device rule into the GDPR, still a proposal.
Solid: in force or published. Dashed: a proposal, or known only from the press.
Is adblock detection personal data under the GDPR?
The GDPR applies to personal data, which includes online identifiers; recital 30 names IP addresses and cookie identifiers, and every server that delivers a script sees IP addresses. Any personal data needs a lawful basis, a retention limit and a line in your privacy notice; keeping raw IP addresses next to detection results, or profiling visitors, adds to what you must justify.
What our script does, from our privacy policy:
| What | Where | How long |
|---|---|---|
| Counts per site and day: checks, blockers seen, recoveries, browser family, device type, approximate country, hour (UTC), most visited page paths | Our statistics, as daily totals | Service history, no visitor identifier |
| A few small entries with no identifier, mainly timestamps, sometimes with the kind of blocking seen | Browser storage on your own domain (a first-party cookie only across subdomains) | 30 days at most |
| IP address | Used in transit for approximate country and abuse protection; not in the statistics; recorded in server access logs with the request | Logs deleted after 14 days |
No fingerprinting. No profiles. No identifier that singles out a visitor.
Because those entries sit on the visitor's device, our policy asks you to describe them in your privacy or cookie notice and to decide, under the rules that apply to you, whether your consent tool must cover them.
Privacy Policy last updated on .
Can you block visitors who use an ad blocker?
The known court cases are about blocking ads, not detecting them. In 2018 Germany's Federal Court of Justice held that offering AdBlock Plus was not unfair competition, describing its use as the autonomous decision of internet users. A copyright claim against an ad blocker went back to the appeal court in July 2025. Neither deals with detection.
Under our terms, what you show is your decision and responsibility, within data protection law too: where consent is needed, a wall that withholds content until visitors accept is assessed case by case, as the CNIL's guidelines say of cookie walls.
Three questions for any notice:
- Does it say ads were blocked, and why they matter to the site?
- Does it show the steps to allow the site?
- Could anyone mistake it for an error or a system message?
Our notice is a wall by default: it asks the visitor to allow ads on the site, shows the steps for their blocker and checks again once they do, in English or Spanish depending on the browser. How a wall compares with the other options is in how to block adblock on your website.
What to do before you switch detection on
- Map your audience: EU, California, elsewhere. The rules differ.
- Know what the script stores: what lives in the browser, for how long, with what identifier. Ours is in the data sheet above.
- Disclose it, naming the vendor as a recipient, in your privacy or cookie notice.
- Decide on consent with your adviser, per country and purpose.
- Keep personal data out: daily totals, no profiles, short log retention.
- Word the notice plainly and date your decision.
If you are a reader: can a website see that you use an ad blocker?
Usually, yes, and in the EU the rules above govern how. Many sites ask you to allow ads or limit what they show; you can leave, allow the site or keep your blocker. Germany's Federal Court of Justice called using a blocker the reader's own decision. If a site reads your device without telling you, your data protection authority takes complaints. This guide does not cover ways around a notice.
Frequently asked questions
Is adblock detection illegal?
We found no law or ruling that bans it as such. In the EU, a script that stores or reads information in the browser needs consent unless an exemption applies, and whether adblock detection fits one is unsettled. Elsewhere, privacy laws such as the CCPA cover the personal data a script collects, for businesses that meet their thresholds.
Do I need consent to run an anti-adblock script in the EU?
Possibly. The EDPB treats browser storage, and scripts that send data back, as storage or access under Article 5(3). The Commission says whether detection falls under the rule must be assessed case by case, so it depends on your setup and your country. Disclose the script either way and take the consent decision with your adviser.
Does the GDPR apply to adblock detection?
Yes, for any personal data involved, and every server that delivers a script sees IP addresses. A script with daily totals, no profiles and no visitor identifier limits that to IP addresses in transit and short-lived logs, which still need a lawful basis and a line in your notice. Logging IP addresses next to detection results, or profiling visitors, adds to what you must justify.
Is it legal to block visitors who use an ad blocker?
What your site shows is your decision; Germany's Federal Court of Justice called using an ad blocker the reader's own decision (2018). The risk sits in how you do it: the device rules for the check, and consumer, accessibility and data protection law for the wall; the CNIL assesses cookie walls case by case. A plain notice is easier to defend.
What does AntiAdBlock Core store in the visitor's browser?
A few small entries on your own domain, mainly timestamps, sometimes with the kind of blocking seen, with no identifier, for 30 days at most. Our statistics are daily totals per site, with no fingerprinting or profiles. The IP address is used in transit and kept only in server logs for 14 days. Our privacy policy asks you to list those entries in your notice.
Sources and dates
Primary texts only, checked on . Each link opens the official text.
- EUR-Lex Directive 2002/58/EC (ePrivacy), Article 5(3), consolidated text of December 19, 2009
- EUR-Lex Directive 2009/136/EC, recital 66 (the revised Article 5(3))
- EDPB EDPB Guidelines 2/2023 on the technical scope of Article 5(3), version 2.0, October 7, 2024
- European Parliament Parliamentary question E-003265/2023 and the Commission's answer, December 22, 2023
- EUR-Lex Regulation (EU) 2016/679 (GDPR), Articles 4(1) and 6, recital 30
- EUR-Lex Court of Justice of the EU, C-673/17 Planet49, judgment of October 1, 2019
- EUR-Lex Notice C/2025/5423, withdrawal of Commission proposals, including the 2017 ePrivacy Regulation (OJ, October 6, 2025)
- EUR-Lex Digital Omnibus proposal, COM(2025) 837, November 19, 2025 (new Article 88a GDPR)
- California Privacy Protection Agency California Consumer Privacy Act, Civil Code 1798.140 (CPPA text, January 2025)
- CNIL CNIL, guidelines on cookies and other trackers, deliberation 2020-091
- Bundesgerichtshof Bundesgerichtshof, I ZR 154/16, April 19, 2018 (press release 78/2018)
- Bundesgerichtshof Bundesgerichtshof, I ZR 131/23, July 31, 2025 (press release 148/2025)
The 2016 Commission letter is known only from press reports (The Register and Nieman Lab, April 2016); we could not read the original.
Our own documents: the Privacy Policy (sections 1, 4 and 6) and the Terms of Service (section 4).
What our script keeps, in short
Daily totals, a few small entries with no identifier for 30 days at most, IP addresses only in 14-day logs. The free plan covers 5,000 detections a month on one site, with no payment method.
Designed for GDPR. Whether you need consent where you publish is your call; we document what the script does so you can make it.