An indigestible cookie: pre-ticked box cookie consent ruled invalid

Website operators should take steps to ensure that they do not fall foul of a recent preliminary ruling on cookies by the Court of Justice of the European Union (CJEU). On 01 October 2019, the CJEU held that a user’s consent to the use of cookies is not valid if consent is given by way of a pre-ticked box.  


The case involved the online gaming company Planet49 GmbH which organised a lottery. To enter the lottery users had to enter their postcodes, names and addresses. They were then presented with two check boxes. The first check box contained information requiring the user to agree to being contacted by third parties with promotional offers. The first box had to be ticked in order for the user to participate in the lottery. The second, pre-ticked, box required the user to consent to the use of cookies on their device.

Referral to the CJEU

The CJEU was asked to consider whether obtaining consent for use of cookies by way of pre-ticked boxes is considered as valid consent. The CJEU was asked for further clarification on whether website operators have to provide users with information specifically related to the duration of the cookies. The court was also asked to confirm if users should be informed of any third parties which may have access to the cookies.

The CJEU held consent must be obtained through some active behaviour on the part of the user. The court found that a pre-checked box does not constitute valid consent.

The court, in its reading of Article 5(3) of the Privacy and Electronic Communications Directive (2002/58/EC), highlighted that whilst a user must give its consent, there is no description as to the way in which the consent must be given. The GDPR has, however, taken a much more stringent approach to obtaining consent. Under the GDPR consent must be freely given, specific, informed and an unambiguous indication of the individual’s wishes. The individual must also give a clear affirmative action and agreement that they wish their data to be processed.

Asking a user to untick a box, causing them to become active where they do not consent to the installation of the cookies, is not a valid consent. Actively ticking the box is, however, a clear and affirmative action of consent to the cookies being used.

This decision is not surprising given Recital 32 of the GDPR which states that “Silence, pre-ticked boxes should not therefore constitute consent”. The recent guidance on cookies from the Information Commissioner also takes this same view.

In relation to the separate questions put to the CJEU concerning the duration of the cookies and access of third parties, the court held that this information should be made available to the users.

What will this mean in practice?

It may be time to dust down and update your cookies policy. If your business uses pre-ticked boxes as a method of gaining consent for all cookies this will have to change. Businesses should ensure that consent is gained by active behaviour such as allowing the user to consent to the cookies. If you do not do so already, you should also make the user aware of how long the cookies will be used to process their data and inform them of any third parties that may have access to this information.

This article was co-authored by Olivia Keary

Latest updates from @MacRoberts

  • Would you like to work at one of Scotland’s leading law firms? We currently have a number of opportunities availabl… 21/06/2021
  • We currently have a vacancy for a Customer Due Diligence Administrator based in Glasgow or Edinburgh. Please shar… 18/06/2021
  • Maya Forstater received a lot of media attention around her tweets relating to her beliefs about sex, resulting in… 18/06/2021
  • Applications for our traineeships starting in 2023 are now open! Get your legal career off to the best possible sta… 18/06/2021
  • RT @DundeeAndAngus: Leading Scottish commercial law firm, @MacRoberts has advised BAM on the ‘game-changing’ Atlantic Square development in… 16/06/2021
  • This week on our new IGTV mini-series, giving an insight into what it’s like to begin a legal career during the pan… 16/06/2021
  • Self-employed status: What does the Uber case really mean? 🚖 Kenny Scott explains what the recent ruling means for… 16/06/2021
  • What is the Scottish #gin industry doing to improve #sustainability? Following #WorldGinDay celebrations over the w… 15/06/2021
  • The European Commission has adopted & published versions of two new sets of Standard Contractual Clauses. What ch… 15/06/2021
  • What impact could Ireland High Court's decision to reject an action by Facebook to block an inquiry by the Irish… 14/06/2021
  • Wishing all of our followers a happy #WorldGinDay! ICYMI: Earlier this week, we were delighted to catch up with… 12/06/2021
  • We're #hiring! We have a #vacancy for a Senior #Solicitor or Associate to join our IP, Technology & Commercial team… 10/06/2021
  • Dealing with an employee's misconduct when that employee contends it is linked to a disability can be tricky - read… 09/06/2021
  • MacRoberts' have launched a new IGTV mini-series, giving an insight into what it’s like to begin a legal career dur… 09/06/2021
  • Scotland's new #landownership transparency register - the Register of Persons Holding a Controlled Interest in Land… 09/06/2021