On the first issue, in the Advocate General’s view the pre-ticked box was not a legally effective way to obtain consent to cookie uses under the e-Privacy Directive. To be valid, consent must be shown by a clear affirmative act. A pre-ticked checkbox does not suffice. The consent must be separate and may not be “bundled” with other consents. In the Advocate General’s view, that is what had happened here. Finally, the Advocate General indicated that he considered that the consent requirement for cookies applies to all data collected regardless of whether or not it qualifies as personal data.
A number of caveats need to be made about this Opinion. Firstly, the main focus of the Opinion was the e-Privacy Directive. However, the Advocate General indicated that the position would be the same under the new General Data Protection Regulation (which became law on 25th May 2018). This is almost certainly the case.
You may also be interested to read the following blogs