The Court of Justice of the European Union (Curia) has made a ruling with far-reaching consequences for digital advertisers and media owners: pre-ticked forms for cookies on websites have been ruled incapable of legally gathering consent to track consumers.

Weeks after a tense Dmexco conference, where the consent framework was questioned alongside the broader legality of programmatic advertising's real-time bidding, this issue boiled over during a legal case against lottery site Planet 49, which requests players to consent to pre-ticked cookies to access its game.

Its pre-ticked cookie boxes (favoured by countless websites after the introduction of GDPR) did not legally gather consent, found the court. Instead users must actively opt-in to have each company (sometimes in their hundreds) follow them across the web.

The German Federation of Consumer Organisations challenged the lottery. German courts then bumped the ruling up to the Court of Justice to interpret EU law.

The judgement passed Monday (1 October) in a case that has lasted more than a year.

It read: “The court decides that the consent which a website user must give to the storage of and access to cookies on his or her equipment is not validly constituted by way of a pre-checked checkbox which that user must deselect to refuse his or her consent.

“That decision is unaffected by whether or not the information stored or accessed on the user’s equipment is personal data. EU law aims to protect the user from any interference with his or her private life, in particular, from the risk that hidden identifiers and other similar devices enter those users’ terminal equipment without their knowledge.”

The user interface did not allow clear access to analyze cookie partners, nor did it inform users that third party cookies may have access (or for how long). And finally, consent was manufactured to provide access to a gambling game that births ethical if not legal concerns about how advertisers could manufacture consent in the future.

Rowly Bourne, founder of Rezonence, home of the FreeWall solution, helping publishers monetise audience data, said; "If you can no longer auto-opt people in, then adtech is going to have a real problem, because consumers do not have a clue who 99% of the 7,040 adtech vendors are. After all, most people think Adobe makes PDFs. So no one will actively opt-in to companies they not heard of. And this will end up shining a light on how consent is achieved in the app-industry.

"This is only going to give further ammunition to the ICO, who already highlighted their concerns regarding consent in their 'Update report into adtech and real time bidding'."

Bourne sees a "good opportunity for publishers, as consumers know who they are, and will opt-in". There's also an opportunity for companies like Rezonence "who believed explicit consumer consent was going to be the conclusion from the GDPR are now well placed".

The Next Web reported the decision even rendered the Curia press release ruling page as illegal with pre-ticked consent boxes.

It appears that the web user experience will be further eroded in the name of user privacy with more strident cookie checks being implemented.

On the other hand, web users may have been dissuaded from opting out of cookies previously due to the sheer length of time it takes to un-tick pre-selected boxes.

Read the full ruling details here.