Pre-Ticked Boxes Are Not Consent: Planet49 Said So in 2019

Planet49 ran an online lottery in Germany, and entry required ticking a box to take part. A second box, pre-ticked, consented to cookies for advertising. The case reached the Court of Justice of the European Union, which ruled on October 1, 2019, in case C-673/17, that a pre-ticked checkbox does not constitute consent.

The reasoning was simple and has not changed since. Consent under GDPR Article 4, paragraph 11, has to be a freely given, specific, informed, and unambiguous indication of wishes, by a statement or a clear affirmative action. A box that is already ticked is not an action by the user. It is an action by the site, and the site cannot consent on the user's behalf.

The case in one paragraph

Active consent means the user does something: ticks an unticked box, clicks a button that says what it does, makes a choice in a settings screen. The action has to be separate for each purpose, because consent has to be specific. One box for marketing emails and analytics together is not specific consent to either. It is a bundle, and bundles fail the same test.

Silence is not consent either. A banner that says 'by continuing to use this site you consent' is not collecting consent, it is announcing that it has taken it. The EDPB Guidelines 05/2020 say the same thing in plainer language: scrolling, swiping, or continuing to browse is not a clear affirmative action.

What counts as active consent

They hide in checkout flows, where a newsletter box sits pre-ticked below the order button. They hide in account creation, where marketing consent is bundled with terms acceptance. They hide in cookie banners that open with all purposes switched on, waiting for the visitor to switch them off. That last one is the most common, and the most expensive, because it looks like a settings screen and behaves like a pre-ticked box.

They also hide in 'remember me' and 'keep me signed in' boxes that are pre-ticked and conflated with marketing consent. A functional preference is not a marketing consent, and bundling the two makes both of them suspect. Audit the form, not the policy: the policy usually says the right thing, and the form does the other thing.

Where pre-ticked boxes still hide

Untick every box by default, separate marketing consent from terms acceptance, and make each purpose its own choice. The conversion rate on the newsletter box will fall, and that is the point: the people who tick it now are the people who want the emails, and the list that results is smaller, cleaner, and actually consented to.

Keep reading: Third-party scripts that set cookies before consent: the tag audit, Consent renewal after a redesign: when the banner must come back.

The fix takes an afternoon

Record the change. Note the date the boxes were unticked, the version of the form, and the consent rate before and after. The rate will drop, and someone will ask why. The answer is a court case from 2019, a case number, and a date. C-673/17, October 1, 2019. That is the whole defence, and it has held for seven years.

Frequently asked questions

What did the Planet49 ruling decide?

That a pre-ticked checkbox does not constitute consent. The Court of Justice ruled on October 1, 2019, in case C-673/17, that consent must be a clear affirmative action by the user, and a box already ticked is an action by the site, not the user.

What counts as active consent?

The user doing something: ticking an unticked box, clicking a button that says what it does, or choosing in a settings screen. Each purpose needs its own choice, because consent must be specific. One bundled box for several purposes fails that test.

Is scrolling or continuing to browse consent?

No. The EDPB Guidelines 05/2020 say scrolling, swiping, or continuing to browse is not a clear affirmative action. A banner that claims continued use means consent is not collecting consent at all.

Where do pre-ticked boxes still appear?

In checkout newsletter boxes below the order button, in account creation where marketing consent is bundled with terms, and in cookie banners that open with all purposes switched on. Audit the form, not the policy: the policy usually says the right thing.