Does a pre-ticked box count as consent in GDPR?

A pre-ticked box does not count as valid GDPR consent because the individual has not actively chosen to agree. Consent must be freely given, specific, informed and unambiguous. Silence, inactivity or leaving a pre-selected option unchanged does not meet that standard. The Court of Justice confirmed this for cookies in its Planet49 ruling.

Consent checkboxes should start unchecked and clearly explain what the person is agreeing to. For websites, cookies that require consent should remain inactive until the visitor makes a valid choice.

Using granular cookie categories helps visitors choose between different purposes. Organisations must also be able to demonstrate consent and make withdrawal of consent as easy as giving it.