EU top court rules that active consent is needed for non-essential cookies, like tracking cookies for targeted ads, rendering pre-checked consent boxes illegal
Europe's top court has ruled that pre-checked consent boxes for dropping cookies are not legally valid.
Context & Ripple Effects
This ruling lands three months after the same court held that sites with embedded Facebook Like buttons are responsible for the data those widgets collect, extending liability for third-party tracking from social plugins to cookies. Together the two judgments make the site operator — not the adtech vendor — the party on the hook for consent.
It also sets the legal benchmark that later coverage tested: a 2020 study found most EU consent forms still use pre-ticked boxes and buried reject options, and the European Data Protection Board followed with guidelines treating scrolling and cookie walls as equally invalid consent. The court has now defined the standard the industry is visibly failing to meet.
First-order effects
- Every EU-facing publisher running pre-checked cookie boxes must re-engineer its consent flow immediately, since the ruling makes those boxes legally void rather than merely bad practice.
- Adtech vendors and networks lose the pre-ticked default that inflated consent rates, so tracking cookies for targeted advertising now require a genuine affirmative click before any data drops.
Second-order effects
- Publishers face a consent-rate drop on non-essential cookies, pressuring ad revenue models that assumed broad opt-in and pushing sites toward contextual advertising or consent-pay walls.
- Consent management platforms become the compliance bottleneck: with the court and later the EDPB tightening what counts as consent, vendors compete on auditable opt-in flows rather than banner placement.
Third-order effects
- The ruling hardens a liability chain that runs from the site operator down to the adtech layer — a trajectory that culminates in the Belgian court's finding that the industry-wide Transparency & Consent Framework itself is illegal across Europe, used by Google, Microsoft, Amazon, and X.
- If regulators keep invalidating consent shortcuts, Europe's targeted-ad ecosystem shifts structurally from implied-by-default consent to explicit, logged, per-purpose permission — raising compliance costs and favoring platforms that can absorb them.
The trend: European courts and regulators are progressively invalidating every consent shortcut in online tracking — pre-ticked boxes, cookie walls, industry frameworks — pushing adtech toward explicit, operator-borne consent.