Court decision · 11 November 2020
Orange România SA v ANSPDCP
Case C-61/19, ECLI:EU:C:2020:901 · Court of Justice of the European Union
What it means for your code
If declining costs the user more clicks than accepting, or the default is set for them, the consent record you are storing will not hold up.
What happened
A telecoms operator kept copies of customers' identity documents on the basis of a contract clause stating the customer had been informed and consented, with the box already ticked by the salesperson and extra paperwork required to refuse.
What was decided
Consent is not valid where it is signalled by a box the controller ticked in advance, where refusing requires the customer to complete an additional form, or where the contract terms mislead about whether the processing is necessary. The controller must be able to prove valid consent.
The legal test applied
- Consent requires an active, informed and freely given indication; a pre-ticked box is not one
- Additional formalities to refuse make consent unfree
- The controller must be able to demonstrate consent was validly given
What would have changed the outcome
- An unticked box with equally easy refusal, and clear information about the purpose, satisfies the test
Summary and analysis by Lawpatch, checked by an editor against the source. Risk analysis, not legal advice; the law may have moved on since this decision.