According to Recital 32 of the GDPR, "pre-ticked boxes" as well as "inactivity" does not count as consent [1]. Planet49 GmbH v Bundesverband der Verbraucherzentralen was probably one of the cases which set the precedence for what constitutes consent. Planet49 had a pre-ticked checkbox on its lottery participation form allowing Planet49 to utilize cookies to track the user's websurfing behaviour and to enable targeted advertising provided by an advertising company [2]. Paragraph 82(1) of the judgment clearly highlights that consent is not valid if the user is presented with a pre-checked box which must be unselected to remove consent.
In Paragraph 61 of the judgment, the court agreed with the Advocate General's position that "clear affirmative action signifying agreement" is required to pass the test of consent [3]. Applying that position to practices in the online world, continuing to scroll through the website will not constitute consent. This is because scrolling through the website is normal behaviour and the user did not deviate from that normal behaviour to perform any "clear affirmative action". Swiping away the consent dialog will also not constitute consent because the user's refusal to interact with the consent dialog would probably count as "inactivity". However, if the website implemented a "swipe right to agree" button, that will constitute as consent because the swiping behaviour would be a "clear affirmative action" that the user partaked in.
According to Recital 32 of the GDPR, consent must be sought for each different purpose of processing. This means that the data controller cannot have a single checkbox seeking blanket consent from the user but has to explicit state the various reasons for seeking consent. I was unable to find any information regarding processing ex ante receiving consent in general. However, logically it should be prohibited. The data controller does not know ahead of time whether consent will be granted by the data subject, if the data subject decides to withhold consent, then the data controller will be in a conundrum. However, in exceptional circumstances, deferred consent is allowed. In Paragraph 3B of the 2021 amendment to Ireland's Data Protection Act, deferred consent is permitted for health research purposes if the data subject is in need of urgent health care and is unable to consent due to the physical or mental state at that material time [4].
[1] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) [2016] OJ L 119/1, Recital 32
[2] Case C–673/17 Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH [2020] 1 WLR 2248.
[3] Bundesverband n(2) Paragraph 61
[4] Data Protection Act 2018 (Section 36(2)) (Health Research) (Amendment) Regulations 2021, Paragraph 3B