By Daniel de Almeida Afonso · Last updated: October 7, 2026
In Planet49 (Case C-673/17), decided on 1 October 2019, the Court of Justice of the European Union ruled that a pre-ticked checkbox is not valid consent to cookies. The Court also held that the rule applies whether or not the cookie data is personal data. Seven years later, it is still the starting point for how EU regulators judge cookie banners.
This article explains what the Court decided, what it left open, and how regulators have built on it since. It is written for privacy leads, marketers and developers who need to know what the ruling requires of a website today.
What happened in the Planet49 case
In 2013, the German company Planet49 ran an online promotional lottery. To enter, users had to give their name and address. Below those fields sat two checkboxes.
- The first checkbox was unticked. It asked for consent to be contacted by sponsors and partners. Users had to tick it to take part.
- The second checkbox was pre-ticked. It asked for consent to cookies that would track browsing behavior for advertising. Users had to untick it to refuse.
The German Federation of Consumer Organisations challenged the pre-ticked box. The German Federal Court of Justice referred questions to the CJEU about how EU law should read consent in this setting. The Court answered on 1 October 2019. You can read the Court's own press release on the judgment.
What the Court decided
The ruling gives you four rules that still apply.
A pre-ticked box is not consent
Consent to store or read cookies cannot come from a box the user must untick. The GDPR already said this. Article 4(11) defines consent as an unambiguous indication of wishes, given by a statement or a clear affirmative action. Recital 32 adds that silence, pre-ticked boxes and inactivity do not count. You can check both in the GDPR text on EUR-Lex.
The Court read the cookie rules the same way. Only active behavior by the user can be consent. That rules out two common shortcuts:
- Pre-ticked boxes or pre-enabled toggles.
- Setting cookies by default and telling users how to opt out afterwards.
The rule applies even if the data is not personal
The Court said the answer does not depend on whether the cookie holds personal data. Article 5(3) of the ePrivacy Directive protects the user's device from hidden identifiers. So consent is needed to store or read information on a device, unless the access is strictly necessary for a service the user asked for.
This is why many analytics and advertising cookies need consent even when the vendor says its data is anonymous.
You must tell users how long cookies last and who can access them
Before asking for consent, you must give clear and comprehensive information. The Court said this includes the duration of the cookies and whether third parties can access them. The goal is that the user can easily work out the consequences of saying yes.
The Court did not say you must name every third party. That is a common misreading. In practice, a vague line such as "partners may access this data" is weak. It sits badly with the GDPR duty to inform people about recipients of their data (Article 13(1)(e)), and regulators have looked for specifics. Naming vendors is the safer approach.
Consent must be specific
Clicking "participate" in the lottery was not consent to cookies. The Court said consent must relate to the processing in question and cannot be inferred from the user's wishes for something else.
In practice, ask for each purpose separately. Do not bundle cookie consent into a button, a terms-of-service tick or a sign-up flow.
What the ruling left open, and what has changed
The Court did not decide every question. Here is where each gap stands in 2026.
Cookie walls. The Court did not rule on whether consent is "freely given" when you must accept advertising cookies to get something, such as entering the lottery. The EDPB later took a position. Its Guidelines 05/2020 on consent, adopted on 4 May 2020, say that making access to a website depend on accepting cookies does not give valid consent. The guidelines also say that scrolling or swiping does not count as a clear affirmative action.
Regulators have since taken a more nuanced line on paid alternatives. The CNIL, for example, says cookie walls are not automatically illegal, but the choices offered must be balanced. For the current picture, see our guide to consent-or-pay models under the GDPR.
Implied consent. An older summary of this ruling listed "implied consent" as unresolved. That is out of date. Planet49 requires active behavior, and EDPB guidance treats "by continuing to browse" and scrolling as insufficient.
Granularity. The judgment did not set out how finely you must split cookie categories. The EDPB's consent guidelines point to separate consent for each purpose. Most compliant banners therefore offer toggles by category, such as analytics and advertising, and keep strictly necessary cookies out of the consent request.
What counts as a "cookie". The EDPB's Guidelines 2/2023, adopted in their final form on 7 October 2024, confirm that Article 5(3) reaches beyond cookies. URL and pixel tracking and other unique identifiers can fall under the same consent rule. Planet49 is the base case, but the scope is wider than the name suggests.
How enforcement has followed
Planet49 is no longer news to regulators. They now check banners at scale. In September 2025, the CNIL fined Google €325 million and SHEIN €150 million. The CNIL cited cookies placed without valid consent, among other findings. You can read the CNIL's announcement. For French rules in detail, see our CNIL cookie guidelines explainer.
In Germany, the Federal Court of Justice applied Planet49 to the original case in 2020. It also held that German law has to be read in line with the Court's ruling.
What happens next
The ePrivacy Regulation, once meant to replace the 2002 directive, was withdrawn by the European Commission in February 2025. The Commission's Digital Omnibus proposal of November 2025 would move cookie consent rules into the GDPR through a new Article 88a. As of this writing, it is a proposal and not adopted law. It would not undo the consent standard set in Planet49, but it could change the details of banners and browser signals. Our article on the Digital Omnibus and Article 88a tracks it.
We found no later CJEU judgment that overturns Planet49 on pre-ticked boxes. The ruling still stands.
A short checklist for your site
Use this to test your own consent flow against the ruling.
- No pre-ticked boxes or pre-enabled toggles for non-essential cookies.
- No consent by scrolling, browsing or closing the banner.
- Cookies and trackers are blocked until the user chooses. A cookie that loads before consent breaks the rule even if the banner looks right.
- Separate consent per purpose. Do not bundle it into sign-up or terms.
- Disclose duration and third-party access for each cookie, ideally with vendor names.
- Keep a record of when and how each visitor chose.
A consent management platform can handle points 3 and 6 for you. Secure Privacy, for instance, blocks scripts until a visitor consents and logs each choice. For the full banner requirements, read our guide to GDPR cookie consent.
Frequently asked questions
What did the Planet49 ruling decide?
The CJEU decided on 1 October 2019 that consent to cookies must be an active choice. A pre-ticked box does not count. The rule applies whether or not the cookie data is personal data. Users must be told how long cookies last and whether third parties can access them.
Does Planet49 still apply in 2026?
Yes. The CJEU has not overturned it, and the EDPB and national regulators such as the CNIL build on it. The Digital Omnibus proposal could change how cookie rules are written, but it is not law yet.
Do I have to name third parties in my cookie notice?
The Court said you must say whether third parties can access the cookies. It did not say you must name them. Naming them is the safer practice, because the GDPR requires information on recipients and regulators expect specifics.
Is a cookie wall allowed after Planet49?
Planet49 did not decide this. The EDPB says that making access depend on accepting cookies does not give valid consent. Some regulators accept balanced alternatives, such as a paid option. Check the guidance in your member state.
Does the ruling apply to cookies that do not process personal data?
Yes. The Court said the consent requirement does not depend on whether the information is personal data. Article 5(3) of the ePrivacy Directive covers any storing of or access to information on a user's device, except what is strictly necessary for a service the user requested.
