CJEU Rules Pre-Ticked Checkboxes Invalid for Cookie Consent

BfDI Press Releases (Germany DPA)

Published October 1st, 2019

Detected February 11th, 2026

Summary

The European Court of Justice (CJEU) ruled that pre-ticked checkboxes are invalid for obtaining cookie consent. This decision, welcomed by data protection authorities, clarifies that active user behavior is required for valid consent regarding data processing.

View original document View source feed page

What changed

The European Court of Justice (CJEU) has ruled that pre-ticked checkboxes on websites are not a valid method for obtaining user consent for storing cookies. The court emphasized that effective consent requires active, specific behavior from the data subject, not passive agreement through a pre-checked box. This ruling directly impacts how websites and online services must obtain consent for cookie usage, particularly in light of ongoing digitalization and data privacy concerns.

This decision necessitates a review of current cookie consent mechanisms by all online service providers operating within the EU. Websites must update their cookie banners to ensure consent is actively given, likely through opt-in checkboxes or similar affirmative actions, rather than relying on pre-ticked boxes. Failure to comply could lead to regulatory scrutiny and potential enforcement actions from data protection authorities, although specific penalties are not detailed in this notice.

What to do next

Review current cookie consent mechanisms to ensure they require active user opt-in.
Update website cookie banners to remove pre-ticked checkboxes and implement affirmative consent.
Consult legal counsel regarding specific implementation details for compliance with CJEU ruling.

Source document (simplified)

Bonn, 01/10/2019

Press release 23/2019

CJEU strengthens Online Declaration of Consent with Regard to Data Protection Law

In its judgment of 01/10/2019, the European Court of Justice (CJEU) reaffirmed the great importance of the online declaration of consent in connection with data protection law. This means that pre-ticket checkboxes which are unmodified by the user do not meet the requirements of effective consent.

The Federal Commissioner for Data Protection and Freedom of Information, Ulrich Kelber, welcomed the ruling of the Court: “The CJEU has again stressed the importance of the free and informed declaration of consent in connection with data protection law. This message is an important signal, especially in times of progressive digitalization, where it is sometimes increasingly difficult to control one’s own data. I assume that this will be taken into account by the legislator in the forthcoming amendment of the Telemedia Act. A similar, legally clear regulation is more than overdue in particular in the context of the use of so-called “cookie banners”. According to today’s ruling, these cookie banners can in principle no longer be used as a legal basis for the storing of cookies.”

The subject matter of the ruling of the supreme European Court was the question under which conditions Internet providers are allowed to store cookies on their users’ terminal equipment. In this context, the CJEU determined that consent, which is effective according to data protection law, also presupposes the data subject’s active behaviour. In addition, this active behaviour should be specifically pertaining to consent. On the other hand, confirmation via a pre-ticked checkbox by clicking on another button, for example to participate in a promotional game, is not sufficient.

Cookies are small text files that are stored by many website on computers or other devices while surfing the Internet. Cookies can include information that is necessary for navigating the Internet, but they can also be used for tracking the individuals’ user behaviour and for creating profiles based on this behaviour.