What is consent under the GDPR?
Article 4(11) says consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Recital 32 says consent should be given by a clear affirmative act, such as a written statement, including by electronic means, or an oral statement. It gives examples: ticking a box when visiting an internet website, choosing technical settings for information society services, or another statement or conduct which clearly indicates acceptance. It then says silence, pre-ticked boxes or inactivity should not therefore constitute consent. Consent should cover all processing activities carried out for the same purpose or purposes. When the processing has multiple purposes, consent should be given for all of them.
Who must be able to demonstrate consent?
Article 7(1): where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. The paragraph does not prescribe a file format. It places the demonstration on the controller.
What if consent sits inside a wider written declaration?
Article 7(2) applies when consent is given in the context of a written declaration which also concerns other matters. The request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
How does withdrawal of consent work?
Article 7(3) says the data subject shall have the right to withdraw his or her consent at any time. The withdrawal shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. That is the whole withdrawal rule in Article 7. It does not say that withdrawal erases the data. Erasure is Article 17, explained separately in GDPR Article 17: Right to Erasure Explained. Once consent has been withdrawn, that consent is no longer the Article 6(1)(a) basis for further processing. Article 6(1)(a) is the basis "the data subject has given consent".
When is consent not freely given?
Article 7(4) says that, when assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Recital 42 says consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
Recital 43 says that, in order to ensure that consent is freely given, consent should not provide a valid legal ground in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. The same recital says consent is presumed not to be freely given in two situations: if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
Those sentences are presumptions and an assessment duty in the Regulation. They do not name a particular website design.
What does Article 8 require for a child's consent?
Article 8(1) applies where point (a) of Article 6(1) applies, in relation to the offer of information society services directly to a child. Processing of the personal data of a child shall be lawful where the child is at least 16 years old. Where the child is below the age of 16 years, such processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility over the child. Member States may provide by law for a lower age for those purposes provided that such lower age is not below 13 years.
Article 8(2) says the controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility, taking into consideration available technology. Article 8(3) says paragraph 1 shall not affect the general contract law of Member States, such as the rules on the validity, formation or effect of a contract in relation to a child. Article 8 does not set one age for every Member State below 16. It sets 16, and a floor of 13 where a Member State chooses a lower age by law.
Which sentence decides the question?
| Situation described in the Regulation | Provision | What that provision says |
|---|---|---|
| Silence, a pre-ticked box, or inactivity | Recital 32 | Should not constitute consent. Consent should be a clear affirmative act. |
| Consent requested inside a written declaration about other matters | Article 7(2) | The request must be clearly distinguishable, intelligible, easily accessible, and in clear and plain language. A part that infringes the Regulation is not binding. |
| Withdrawal that is harder than giving consent | Article 7(3) | It shall be as easy to withdraw as to give consent. The person must be informed of the right before giving consent. |
| A contract or service is conditional on consent that is not necessary for that performance | Article 7(4) and Recital 43 | Article 7(4) requires utmost account of that condition. Recital 43 presumes the consent is not freely given. |
| No genuine choice, or refusal or withdrawal only with detriment | Recital 42 | Consent should not be regarded as freely given. |
| Clear imbalance, in particular a public-authority controller | Recital 43 | Consent should not provide a valid legal ground in that specific case where it is unlikely that consent was freely given in all the circumstances. |
| Information society service offered directly to a child, on the basis of Article 6(1)(a) | Article 8(1) and (2) | Lawful where the child is at least 16, or at a lower Member State age not below 13. Below that age, only if and to the extent parental responsibility consents or authorises, with reasonable efforts to verify. |
How was this guide checked?
Each legal sentence was checked against the English text of Articles 4(11), 6(1)(a), 7 and 8 and Recitals 32, 42 and 43 of Regulation (EU) 2016/679 in OJ L 119, 4.5.2016. The text used was the Publications Office HTML of that Official Journal. The responsible organisation is GDPR Exam Trainer. This is a study guide, not legal advice.
Frequently asked questions
These answers use Article 4(11), Article 7, Article 8 and the three recitals above.
What does consent mean in the GDPR?
Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.
What extra conditions does Article 7 add?
Article 7(1) requires the controller to be able to demonstrate consent. Article 7(2) requires a consent request inside a wider written declaration to be clearly distinguishable, intelligible, easily accessible, and in clear and plain language. Article 7(3) gives a right to withdraw at any time, requires the person to be told of that right beforehand, and requires withdrawal to be as easy as giving consent. Article 7(4) requires utmost account of whether a contract or service is conditional on consent that is not necessary for that contract.
Does withdrawing consent make the earlier processing unlawful?
No. Article 7(3) says the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Article 7(3) does not itself order erasure.
When does Article 8 set an age for consent?
Only where Article 6(1)(a) applies, in relation to the offer of information society services directly to a child. Article 8(1) says processing shall be lawful where the child is at least 16 years old. Member States may set a lower age by law, not below 13 years. Below the applicable age, processing shall be lawful only if and to the extent that consent is given or authorised by the holder of parental responsibility.