Consent
Consent requires that a data subject provides a clear, affirmative action to agree to the processing of their personal data. This agreement must be freely given, specific, informed, and unambiguous, with the controller bearing the burden of proving these conditions were met.
What it means
In practice, consent is one of several legal bases for processing personal data under the GDPR. It is intended to give individuals genuine control over their information. For consent to be valid, there must be a clear imbalance-free choice; if an individual feels forced to consent to receive a service that does not strictly require that data, the consent is generally not considered "freely given."
Consent cannot be bundled into a general set of Terms and Conditions. It must be isolated so the user knows exactly what they are agreeing to. Furthermore, it must be specific, meaning you cannot ask for one blanket consent for multiple unrelated processing activities.
Finally, the GDPR mandates that withdrawing consent must be as easy as giving it. If a user can opt-in with one click, they should be able to opt-out via a similarly simple process without facing undue hurdles.
How to meet it
- Implement active opt-in mechanisms, such as an unchecked checkbox or a toggle switch; avoid pre-ticked boxes.
- Draft consent requests in plain, easy-to-understand language, avoiding complex legal terminology.
- Separate the consent request from other contractual terms and conditions so it is clearly distinguishable.
- Create granular consent options where users can agree to different types of processing independently (e.g., separate checkboxes for email marketing and data sharing with third parties).
- Provide a clear "Withdraw Consent" mechanism, such as an unsubscribe link or a preference center, that requires minimal effort from the user.
- Explicitly state who the data controller is and exactly what the personal data will be used for at the point of collection.
Evidence an auditor asks for
- Time-stamped consent logs showing when the user consented, what they were told (version of the notice), and how they consented.
- Screenshots or recordings of the User Interface (UI) flow that demonstrate the active opt-in process.
- Documentation of the internal workflow used to process withdrawal requests and stop data processing accordingly.
- A copy of the privacy notice provided to the user at the moment consent was captured.
Common pitfalls
- Bundling: Making consent a mandatory condition for providing a service when that data is not strictly necessary for the performance of the contract.
- Dark Patterns: Using deceptive UI design, such as contrasting colors or confusing language, to nudge users toward consenting.
- Implicit Consent: Incorrectly assuming that silence, inactivity, or continued use of a website constitutes valid agreement.