The highest legal entity of the EU, the Court of Justice of the European Union (CJEU), ruled that the only form of valid consent for processing user data in the EU is explicit consent, i.e. consent that is actively and specifically given by the website users by e.g. ticking a box.

This verdict is the first post GDPR that deals explicitly with consent relating to website cookies and tracking. Therefore, it is of very importance to the privacy industry and to all website owners, establishing a legal precedent that has a de facto effect on the legal requirements for cookies moving forward and until the ePrivacy Regulation is passed into law and takes effect.

This gives clarity on the CJEU’s ruling, clear up the terminology on consent (explicit/implied, active/soft opt in), and explain in plain terms what the consequences are for websites owners and operators, not just in the EU, but across the world.

The official press release from the CJEU removes any confusion: it is titled Storing cookies requires internet users’ active consent and makes it clear that “a pre-ticked checkbox is therefore insufficient”.

Any cookies not strictly necessary are prohibited from being pre-checked, regardless of whether the data processed is categorized as personal.