Non-essential cookie categories default to unchecked/off; no pre-ticked boxes

GDPR Art. 4(11) defines consent as a 'freely given, specific, informed and unambiguous indication' — pre-ticked boxes satisfy none of those criteria. The CJEU's Planet49 ruling (C-673/17, 2019) settled this definitively: checkboxes ticked by default do not constitute valid consent under either GDPR Art. 7(2) or ePrivacy Art. 5(3). Any analytics or marketing data collected under a pre-ticked opt-out model is collected without lawful basis, making every downstream use — ad targeting, conversion tracking, behavioral profiling — equally unlawful.

Set every non-essential category to false in the initial state. The necessary flag is the only one that may be true and non-interactive — it is exempt under ePrivacy Art. 5(3)'s 'strictly necessary' carve-out.

// WRONG — opt-out model, GDPR violation
const [consent, setConsent] = useState({
  necessary: true,
  analytics: true,   // pre-ticked: invalid consent
  marketing: true,   // pre-ticked: invalid consent
})

// CORRECT — opt-in model
const [consent, setConsent] = useState({
  necessary: true,   // exempt; no toggle needed
  analytics: false,  // user must actively choose
  marketing: false,  // user must actively choose
})

For managed platforms like Cookiebot, verify that no defaultAccept or impliedConsent flag is set in the initialization config. For OneTrust, impliedConsent must be false.