CJEU - C-61/19 - Orange Romania
CJEU rules consent invalid if contracts mislead customers on ID data storage.
The Court of Justice of the European Union (CJEU) ruled that Orange Romania's method of obtaining consent for storing customer ID copies was invalid under GDPR. The court found that consent is not freely given if contracts imply refusal is difficult or requires extra steps, such as filling out a separate form, or if pre-ticked boxes are used.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Orange Romania?
Get an email when a new story names Orange Romania, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonOrange Romania violated GDPR by using implied or coerced consent mechanisms — including pre-ticked boxes and burdensome opt-out processes — to collect and store copies of customer ID documents. The CJEU reaffirmed that valid consent must be freely given, specific, informed, and unambiguous, meaning any friction that discourages refusal automatically invalidates the consent. This ruling matters because organizations cannot treat consent as a checkbox formality; it must reflect a genuine, affirmative choice by the data subject. Businesses that embed consent into standard contract flows without a clear, equal opt-out risk significant regulatory exposure and reputational damage.