Art.7
Conditions for consent
Defines what constitutes valid consent — freely given, specific, informed, unambiguous — and that pre-ticked boxes do not count (Planet49 ruling).
Why it matters for SaaS exits
The Planet49 ruling (CJEU 2019) made pre-ticked consent boxes invalid. SaaS sites that still use 'Accept All' as default, or bury consent in terms-of-service, are operating with invalid consent — meaning every analytics/marketing cookie set is unlawful. Buyers' lawyers check this first because it's the easiest thing to litigate.
What we scan for
We check registration and signup forms for pre-checked consent checkboxes, and verify the cookie banner requires active opt-in (not pre-accepted). Sites with 'consent by default' fail this check.
Automated checks (0)
No automated checks map to this article yet.
Buyer due-diligence checklist
- ▸Test the signup flow: are any consent checkboxes pre-ticked?
- ▸Check if the cookie banner defaults to 'Accept All' or requires explicit choice.
- ▸Verify users can withdraw consent as easily as they gave it (Art.7(3)).
Run this scan on your site
See exactly where your site stands on Art.7 before a buyer asks.
Scan free →