Pre-Ticked Boxes Are Still Illegal: The Planet49 Rule in Practice
A visitor clicks Reject All, and your analytics setup faces a question it was never designed to answer: what do you still get to know about someone who said no. In Consent Mode v2 the answer is specific. With analytics_storage denied, Google Analytics 4 stops setting cookies and stops collecting identifiers, but in advanced mode it still sends cookieless pings: the page, the timestamp, the conversion event, no identity attached. In basic mode it sends nothing at all. The difference between those two sentences is the difference between a reporting gap and a reporting hole.
Consent Mode v2 has been mandatory for EEA and UK advertisers since March 2024, and it runs on four signals: ad_storage, analytics_storage, ad_user_data, and ad_personalization. The analytics question is about one of them, and it is the one most sites misunderstand.
Pre-ticked consent boxes are illegal under GDPR. The Court of Justice ruled in Planet49, case C-673/17, on 1 October 2019, that consent requires an active, affirmative act, and a box that arrives already ticked is not one. Every box in a consent panel has to start unticked, and the visitor has to tick it themselves.
What the court actually decided
Planet49 ran a lottery website that asked visitors to consent to cookies with a pre-ticked box. The German Federal Court of Justice asked the Court of Justice whether that counted as consent. The answer was no, on two grounds. First, GDPR Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication by a statement or a clear affirmative action. Silence, inactivity, and a box someone else ticked are none of those. Second, the ePrivacy Directive requires consent for storing information on a device, and the same standard applies.
The ruling also settled that it does not matter whether the cookies are for advertising or analytics, and it does not matter that the visitor could have unticked the box. The burden is on the site to obtain an active yes, not on the visitor to undo a yes they never gave. That is the whole rule, and it has been the law for seven years.
Where pre-ticked boxes still hide
The obvious place is the consent panel itself: purposes or vendors with boxes already checked when the panel opens. The less obvious places are the settings that ship with a default. A preference center that opens with advertising ticked and analytics unticked is pre-ticked for advertising, whatever the banner said. A CMP template that defaults new purposes to on is pre-ticked by configuration, and the site owner who never changed the default has still shipped an illegal default.
The third hiding place is the cookie wall that treats scrolling as consent. Inaction is not an affirmative action, and the CNIL has been explicit that scrolling or continuing to browse does not count. A banner that records consent because the visitor scrolled past it is recording something the visitor never did.
Checking your own panel in two minutes
Open the site in a private window, open the preference center, and look at every box before touching anything. Every one should be empty. If any is ticked, the CMP or the template set it that way, and it needs changing at the source, not by unticking it for one visitor. Then check the network panel after rejecting everything: if tracking requests still fire, the reject path is decorative, and that is a separate failure to fix.
Log the check with the date and a screenshot of the unticked panel. It takes two minutes and it is the evidence that the panel was compliant on that date. A consent program is a set of checks like this one, repeated, not a banner installed once and forgotten.
Keep reading: Consent Renewal: How Often to Re-Ask, and What Resets the Clock, Consent Mode and Analytics: What Breaks When Users Say No, and Your Banner Keeps Coming Back Because the Consent Cookie Died cover the nearby cases in this series.
Frequently asked questions
Are pre-ticked boxes really illegal, or just discouraged?
Illegal. The Court of Justice ruled in Planet49 in October 2019 that a pre-ticked box is not valid consent under GDPR, because consent needs a clear affirmative action from the visitor.
What if the visitor can untick the box?
It does not matter. The court held that the visitor has to actively give consent, not actively remove a consent the site assumed. The box has to start empty.
Does the rule apply to analytics cookies too?
Yes. The ruling covers any non-essential cookie storage, including analytics. Only strictly necessary cookies are exempt from the consent requirement.
My CMP template came with boxes ticked. Whose fault is that?
Yours, once you ship it. The vendor supplies the template, but the site owner is responsible for what goes live. Change the default in the CMP configuration and verify it in a private window.