Pre-Ticked Boxes Are Not Consent: The Fines Proved It

A pre-ticked box is not consent. The Court of Justice said so in 2019, the CNIL has fined companies hundreds of millions since, and the pattern is still on half the banners on the internet. The fine for getting this wrong is not theoretical anymore.

The law has been settled since 2019

The Court of Justice of the European Union settled the pre-ticked box question in the Planet49 case, C-673/17, on October 1, 2019. The court ruled that consent requires an active indication of the user's wishes, and a pre-selected checkbox that the visitor must untick does not meet that standard. GDPR Recital 32 says the same thing in plain language: silence, pre-ticked boxes, or inactivity do not constitute consent. The European Data Protection Board's Cookie Banner Taskforce, in its report of January 2023, confirmed that pre-ticked opt-in boxes do not lead to valid consent, including at the second layer of a banner.

There is no ambiguity left, and there has not been for seven years. A banner with pre-ticked boxes is collecting consent that is not valid, and every cookie placed on the strength of that consent is placed without a legal basis. The question is not whether the pattern is illegal. It is whether the regulator has got to your site yet.

The CMP migration post showed what a consent reset costs when a platform changes: the opt-in rate falls, and the business feels it. A pre-ticked box avoids that cost by taking consent the user did not give, and the fine is the price of that shortcut.

The fines are not theoretical anymore

In September 2025, France's CNIL fined Google 325 million euros, partly for ads shown between emails in Gmail without consent, and for invalid consent to advertising cookies when people created a Google account. It was Google's third CNIL fine for cookies, after 100 million in 2020 and 150 million in 2021. In the same month, the CNIL fined SHEIN 150 million euros, because advertising cookies were placed on visitors' devices the moment they arrived, before any interaction with the banner, and because the reject and withdrawal mechanisms did not work.

The CNIL is not only fining the largest companies. It sanctioned 21 organisations in 2025 alone, and its list of sanctions includes many fines ranging from 2,000 to 20,000 euros imposed through simplified procedures. The Dutch authority warned 50 organisations about misleading banners in April 2025. The enforcement is broad, and it is accelerating, because the law is settled and the pattern is easy to detect.

The live chat widget post covered a different script that runs before consent. The pre-ticked box is the same failure in the banner itself: the consent is collected before it is given, and the script runs on the strength of it.

The fix is a configuration change

Set every optional category to off by default, and only switch a category on when the visitor actively chooses it. Only strictly necessary storage stays on, marked as always active, with a one-line explanation beside each toggle. That is the fix, and it is a configuration change in the CMP, not a redesign of the banner. It takes an afternoon, and it removes the largest single compliance risk on most sites.

The second half of the fix is the reject option. Rejecting has to take no more effort than accepting, which means a reject all button of the same size and at the same level as accept all, on the first layer. A reject link buried in the text, or a reject button that is smaller and greyer than the accept button, fails the same test as the pre-ticked box, and for the same reason: the consent it produces is not freely given. Fix both, and the banner is honest. Leave either, and the banner is a fine waiting for a date.

Frequently asked questions

When were pre-ticked boxes ruled invalid?

The Court of Justice of the European Union, in the Planet49 case, C-673/17, on October 1, 2019. The court ruled that a pre-ticked box that the visitor must untick does not constitute valid consent, because consent requires an active indication of the user's wishes. GDPR Recital 32 says the same thing: silence, pre-ticked boxes, or inactivity do not constitute consent.

What fines have regulators imposed for cookie dark patterns?

In September 2025, the CNIL fined Google 325 million euros, partly for ads shown in Gmail without consent and for invalid consent to advertising cookies when people created a Google account. In the same month, it fined SHEIN 150 million euros for placing advertising cookies before any user choice and for ineffective reject mechanisms. Earlier, in 2022, it fined Google 150 million euros because refusing cookies took several clicks while accepting took one.

Can the reject option be a small link while accept is a big button?

No. The rule is that rejecting must take no more effort than accepting, and that is the position of the EDPB Cookie Banner Taskforce report of January 2023, which found that a vast majority of national authorities consider a missing first-layer reject option an infringement. The CNIL's guidance calls for a reject all button of the same size and at the same level as accept all.

How do I fix pre-ticked boxes on my banner?

Set every optional category to off by default, and only switch a category on when the visitor actively chooses it. Only strictly necessary storage stays on, marked as always active, with a one-line explanation beside each toggle. That is the fix, and it is a configuration change, not a redesign.

Are small sites fined for this too?

Yes. The Dutch authority warned 50 organisations about misleading cookie banners in April 2025, and the CNIL sanctioned 21 organisations in 2025 alone. The fines are not only for the largest companies. Small and medium sites are fined too, usually in the range of a few thousand to tens of thousands of euros, through simplified procedures.