GDPR: No effective consent with preselected checkbox

"[...]Art. 4 no. 11 and Art. 6 para. 1 lit. a of the [GDPR] must be interpreted as meaning that it is for the data controller to demonstrate that the data subject has given his consent to the processing of his personal data by active conduct and that he has previously received information on all the circumstances relating to that processing in an intelligible and easily accessible form, using clear and plain language, enabling him to determine easily the consequences of that consent, so as to ensure that consent is given in full knowledge of the facts. A contract for the provision of telecommunications services which contains a clause stating that the data subject has been informed of and has consented to the collection and storage of a copy of his or her identity document with an identification function shall not constitute proof that that person has validly given his or her consent to the collection and storage of those documents within the meaning of those provisions if

- the box referring to this clause has been checked by the data controller before signing this contract, or if

- the contractual provisions of this contract may mislead the data subject about the possibility of concluding the contract, even if he/she refuses to consent to the processing of his/her data, or if

- the free choice to oppose such collection and storage is unduly impaired by that controller by requiring the data subject to sign an additional form expressing that refusal in order to refuse consent."

(ECJ, judgment of 11.11.2020, Case C-61/19; emphasis in bold by us)

Please see our detailed discussion of the judgment in: Hötzel, No proof of consent solely by means of a checkmark/checkbox set by the person responsible, Judgment of the ECJ, Urt. v. 11.11.2020, Case C-61/19, Data Protection Advisor 2020, 305.