HighChecked on every planEU

Consent categories are pre-ticked

Are pre-ticked cookie categories allowed?

Short answer

No. The EU’s top court ruled in 2019 (Planet49) that a pre-ticked box is not consent. Analytics, marketing and other optional categories must start switched off. Only strictly necessary cookies may be on.

4%of 168 European shops did this (7)
No. 2most common high problem in the study

Why it matters

The EU’s top court ruled that a pre-ticked box is not consent. Anything collected this way has no legal basis.

How to fix it

  1. Default every non-essential category to off.
  2. Only strictly necessary cookies may be on (and should be locked, not toggled).
Steps for OneTrust
  1. In Geolocation Rules, set the EU rule to the Opt-in model.
  2. Check each non-essential category starts as Inactive in the preview.
  3. Republish the script.
OneTrust docs, checked October 2026
Steps for Cookiebot
  1. Open the Dialog tab and the “Multilevel” type.
  2. Under Additional settings, check no box is ticked except Necessary.
  3. Set the consent method to “Explicit consent”.
Cookiebot docs, checked October 2026
Steps for Usercentrics
  1. Open the banner preview and go to the second layer.
  2. No toggle should be on except Essential.
  3. Switch any other on-by-default service off in its settings.
Usercentrics docs, checked October 2026
Steps for Didomi
  1. Edit your notice and open the preferences view.
  2. Every purpose should start off.
  3. Turn off any purpose that is on before the visitor chooses.
Didomi docs, checked October 2026
Steps for CookieYes
  1. Open Cookie Manager, then Cookie Category.
  2. Check that only Necessary is on by default.
  3. Under General, set Consent Template to GDPR for EU visitors.
CookieYes docs, checked October 2026

The law behind this rule