On the 1st October 2019, the CJEU in Case C‑673/17 has clarified that Article 5(3) of the E-privacy Directive (the so-called Cookie Law) and the GDPR provisions on consent require actively signified consent to the use of cookies. Accordingly, the use of pre-checked boxes (and other ways of inferring consent such as from the act of a user reading a Web page) do not allow for the securing of valid user consent. This approach is consistent with consent requirements in other contexts, such as Article 22 of the Consumer Rights Directive. The said provision specifically states that that pre-checked boxes referring to charges for additional products to be incurred by the consumer when he submits an order for a main product do not constitute valid consent to such additional charges. It would seem that consent means consent under EU law! The approach taken by the CJEU is also consistent with the views expressed a few years ago by Christiana Markou, lawyer of our office, when she illustrated that Data Protection Authorities and other officials were wrong in the way they were interpreting the relevant (cookies) provision of the e-Privacy Directive, perhaps due to the strong business resistance towards the relevant consent requirement. You can find her related work titled Markou, C. Behavioural Advertising and the New “EUCookie Law” as a Victim of Business Resistance and a Lackof Official Determination. Data Protection on the Move: Current Developments in ICT and Privacy/Data Protection (2016), 213–247 here: https://www.springerprofessional.de/behavioural-advertising-and-the-new-eu-cookie-law-as-a-victim-of/7085912