Tick…Tick…Boom!

After CJEU ruling, pre-ticked consent boxes could blow up in merchants' faces

A Court of Justice of the European Union (CJEU) ruling late last year places much greater restrictions on how video game and other websites obtain users' permission to collect and store their personal data. From now on, any company wishing to gather and use player or customer data must ensure consent is "freely given" through an "affirmative action." The ruling, which gives the General Data Protection Regulation (GDPR) more bite, affirms a fine handed down by the court's Advocate General panel against telecommunications firm Orange Romania for:

[Failure] to demonstrate that the data subject has, by active behavior, given his or her consent to the processing of his or her personal data and that he or she has obtained, beforehand, information relating to all the circumstances surrounding that processing, in an intelligible and easily accessible form, using clear and plain language,