Changeflow GovPing Data Protection CJEU Rules Pre-Ticked Checkboxes Invalid for Co...
Priority review Notice Amended Final

CJEU Rules Pre-Ticked Checkboxes Invalid for Cookie Consent

BfDI Press Releases (Germany DPA)
Published October 1st, 2019
Detected February 11th, 2026
Email Set alert

Summary

The European Court of Justice (CJEU) ruled that pre-ticked checkboxes are invalid for obtaining cookie consent. This decision, welcomed by data protection authorities, clarifies that active user behavior is required for valid consent regarding data processing.

What changed

The European Court of Justice (CJEU) has ruled that pre-ticked checkboxes on websites are not a valid method for obtaining user consent for storing cookies. The court emphasized that effective consent requires active, specific behavior from the data subject, not passive agreement through a pre-checked box. This ruling directly impacts how websites and online services must obtain consent for cookie usage, particularly in light of ongoing digitalization and data privacy concerns.

This decision necessitates a review of current cookie consent mechanisms by all online service providers operating within the EU. Websites must update their cookie banners to ensure consent is actively given, likely through opt-in checkboxes or similar affirmative actions, rather than relying on pre-ticked boxes. Failure to comply could lead to regulatory scrutiny and potential enforcement actions from data protection authorities, although specific penalties are not detailed in this notice.

What to do next

  1. Review current cookie consent mechanisms to ensure they require active user opt-in.
  2. Update website cookie banners to remove pre-ticked checkboxes and implement affirmative consent.
  3. Consult legal counsel regarding specific implementation details for compliance with CJEU ruling.

Classification

Agency
Various DPAs (CNIL, BfDI, AEPD, etc.)
Published
October 1st, 2019
Instrument
Notice
Legal weight
Binding
Stage
Final
Change scope
Substantive

Who this affects

Applies to
Technology companies Retailers Importers and exporters
Geographic scope
EU-wide

Taxonomy

Primary area
Data Protection
Operational domain
Compliance
Topics
Online Advertising Privacy

Get Data Protection alerts

Weekly digest. AI-summarized, no noise.

Free. Unsubscribe anytime.