As regards the prerequisites for legitimate consent beneath the GDPR, the CJEU, in its ruling on Orange România SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal, made a decision that valid consent simply cannot be inferred from a preselected box in a contract for the provision of telecommunications products and services, whereby the purchaser allegedly consents to the selection and storage of his/her.