The CJEU has delivered another judgment to remind us that pre-ticked boxes do not constitute valid consent under the GDPR.

To be valid, consent must be freely given, specific, informed and an unambiguous indication of an individual's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her [emphasis obviously added].

It couldn't be much clearer, pre-ticked boxes are not an affirmative action!

See our blog post below for more insights into this case.

The contracts included a pre-ticked box stating that the customer had been informed of and given his consent to the collection and storage of his identity documents. ANSPDCP determined that Orange România had failed to prove that their customers had given a legally valid consent.