CJEU - C-61/19 - Orange Romania
CJEU rules that pre-ticked consent boxes and handwritten opt-out requirements violate GDPR consent standards.
The Court of Justice of the European Union (CJEU) in case C-61/19 ruled on Orange România's appeal against a Romanian data protection authority penalty for storing customer ID copies without valid consent. The court clarified that 'freely given' and 'informed' consent under GDPR requires active, not passive behavior; pre-ticked checkboxes and requiring handwritten refusal on standardized contracts do not meet consent requirements. The decision establishes that controllers must bear the burden of proving valid consent and that consent cannot be conditional on contract conclusion.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Orange România?
Get an email when a new story names Orange România, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOrange România was penalized for collecting copies of customer ID documents without obtaining valid consent — relying on pre-ticked checkboxes and requiring customers to manually write a refusal rather than actively opt in. The CJEU confirmed that GDPR consent must be a freely given, specific, informed, and unambiguous indication of agreement, meaning passive or coerced consent mechanisms are unlawful. Critically, the court placed the burden of proving valid consent squarely on the data controller, not the data subject. This case matters because many organizations still use dark patterns or bundled consent clauses that superficially appear compliant but do not meet GDPR's active consent standard. Failing to design lawful consent flows exposes organizations to regulatory fines, reputational damage, and potential data processing invalidation.
What helps against this
How we list vendors- Compliance automation (GRC)
Evidence for NIS2, DORA and ISO 27001 is collected continuously, not in a rush before the audit.