Does a pre-ticked box count as consent in GDPR?

Pre-ticked boxes are not valid forms of consent under the GDPR. Recital 32 of GDPR states that consent should be given by a clear affirmative action and should be freely given, a specific, informed and unambiguous indication of the user’s agreement to the processing of their personal data. This means the processing of a user’s personal data requires affirmative, opt-in consent from the user. Hence, pre-ticked boxes or inactivity from the user cannot constitute valid consent.

In a 2019 ruling, the Court of Justice of the European Union (CJEU) noted that a pre-checked check box that users must actively deselect cannot be considered a valid form of consent. The opinion was again confirmed in a 2020 ruling by the CJEU.