Case Law · CJEU EN LLM context A cited markdown file you can paste into your AI assistant (ChatGPT, Claude, a RAG or project knowledge base) to ground it in this document. Contains: this document’s text, its sections with their topics, and the full text of every law provision it applies. Everything links back to its source on overview.legal — legal information, not advice.
CJEU Planet49: pre-ticked checkboxes do not constitute valid consent under ePrivacy
Original title: BUNDESVERBAND DER VERBRAUCHERZENTRALEN UND VERBRAUCHERVERBANDE —BERBRAUCHERZENTRALE BUNDESVERBAND V. PLANET49 GmbH (“PLANET49”)
Judgment
Summary
Consent is “not validly constituted if the storage of information, or access to information already stored in an website user’s terminal equipment, is permitted by way of a checkbox pre-ticked by the service provider which the user must deselect to refuse his or her consent.” The indication of the data subject’s wishes must, inter alia, be ‘specific’ in the sense that “it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subj
Full text
summary
Consent is “not validly constituted if the storage of information, or access to information already stored in an website user’s terminal equipment, is permitted by way of a checkbox pre-ticked by the service provider which the user must deselect to refuse his or her consent.” The indication of the data subject’s wishes must, inter alia, be ‘specific’ in the sense that “it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subject’s wishes for other purposes.” (¶57–58)
¶57 excerpt
As regards the foregoing, the consent referred to in Article 2(f) and Article 5(3) of Directive 2002/58, read in conjunction with Article 2(h) of Directive 95/46, is therefore not validly constituted if the storage of information, or access to information already stored in an website user’s terminal equipment, is permitted by way of a checkbox pre-ticked by the service provider which the user must deselect to refuse his or her consent.
¶58 excerpt
It should be added that the indication of the data subject’s wishes referred to in Article 2(h) of Directive 95/46 must, inter alia, be ‘specific’ in the sense that it must relate specifically to the processing of the data in question and cannot be inferred from an indication of the data subject’s wishes for other purposes.
How it connects
Related across sources
Guidelines 2/2023 Technical Scope of Art. 5(3) of ePrivacy Directive Oct 16, 2024 Cookies Identification Direct Marketing
Guidelines 05/2020 consent under Regulation 2016/679 Guidelines on consent May 4, 2020 Consent Data Portability Personal Data
Guidelines 4/2019 Article 25 Data Protection by Design and by Default Version 2.0 Adopted on 20 October 2020 Guidelines on data protection by design and by default Oct 20, 2020 Privacy by Design & Default Privacy by Default Privacy by Design
Guidelines 06/2020 interplay of the Second Payment Services Directive and the GDPR Guidelines on the Interplay between the application of Article 3 and the provisions on international transfers as per Chapter V of the GDPR Dec 15, 2020 International Transfer GDPR Article 5 Principles of Processing Personal Data
Guidelines 1/2020 processing personal data in the context of connected vehicles and mobility related applications Guidelines on processing of personal data through video devices Jan 28, 2020 Personal Data Privacy by Design & Default Processing