GDPR – Consent

Published by the Secure Privacy Compliance Team · Last reviewed: Feb 2026

Consent is one of six legal bases in Article 6. It is valid only if it is freely given, specific, informed and unambiguous, and the controller must be able to prove it. If one condition fails, there is no consent, so the processing has no legal basis. Breaches of the consent conditions fall in the higher fine tier.

In short

Consent needs a clear affirmative action by a person who had a real choice, was asked about a specific purpose and knew what they were agreeing to. Silence, pre-ticked boxes and inactivity do not count (Recital 32).

Article 7 adds four working rules: prove it, keep the request separate from other terms, make withdrawal as easy as giving consent, and don’t make a service conditional on consent it doesn’t need. Special category data requires explicit consent.

In This Page
Art. 4(11)Defines consent: a freely given, specific, informed and unambiguous indication of wishes, by a statement or a clear affirmative action.GDPR
Art. 6(1)(a)Lists consent as one of six legal bases for processing.GDPR
Art. 7Sets the conditions for relying on consent: proof, a distinguishable request, withdrawal at any time, and limits on conditionality.GDPR
Art. 8Online services offered directly to children: consent is valid from age 16, or a lower national age of at least 13. Below that, a parent must give or authorise it.GDPR
Art. 9(2)(a)Allows special category data to be processed with explicit consent.GDPR
Art. 83(5)(a)Places breaches of the conditions for consent (Art. 5, 6, 7 and 9) in the higher tier: up to €20 million or 4% of worldwide annual turnover.GDPR

The Four Conditions

Freely given

The person must be able to refuse or withdraw without detriment (Recital 42). Consent is unlikely to be free where there is a clear imbalance of power, or where a service is made conditional on consent to processing it doesn’t need (Art. 7(4), Recital 43).

Specific

Consent must cover defined purposes. Where processing has several purposes, consent should be given for each (Recital 32). Accepting general terms as a whole is not specific consent.

Informed

The person must know at least who the controller is and what the processing is for (Recital 42), and be told of the right to withdraw before consenting (Art. 7(3)).

Unambiguous

It requires a clear affirmative act, such as ticking an empty box. A pre-ticked box is not consent (CJEU, Planet49, C-673/17). The EDPB’s consent guidelines add that scrolling or swiping through a page is not consent either.

Article 7: The Working Rules

  • Prove it (7(1)). The controller carries the burden of showing that consent was given.
  • Separate it (7(2)). A consent request inside a wider document must be clearly distinguishable, in clear and plain language.
  • Allow withdrawal (7(3)). Withdrawing must be as easy as giving consent. Withdrawal does not make earlier processing unlawful, but the processing must stop.
  • Don’t bundle it (7(4)). Making a service conditional on consent to unnecessary processing weighs heavily against the consent being free.

When Consent Must Be Explicit

Explicit consent is required for special category data (Art. 9(2)(a)), for solely automated decisions with significant effects (Art. 22(2)(c)) and for transfers under the Art. 49(1)(a) derogation. It means an express statement, such as a written or signed confirmation, not consent inferred from an action.

Consent and Cookies

Article 5(3) of the ePrivacy Directive requires consent for non-essential cookies and similar technologies, to the GDPR standard. Planet49 was a cookie case: the Court also held that users must be told how long cookies operate and whether third parties can access them.

Real Cases

In both cases below, the regulator’s finding that consent was invalid was upheld on every appeal decided so far.

CompanyAuthority & dateFineWhat happened
Google LLCCNIL (France), Jan 2019€50.000.000Consent to ad personalisation on Android was not informed, used a pre-ticked box and was given for all purposes at once. Upheld by the Conseil d’État, June 2020.
Grindr LLCDatatilsynet (Norway), Dec 2021NOK 65.000.000Users had to accept the whole privacy policy, including sharing with advertisers, to use the app. Upheld by the Privacy Appeals Board and two courts.

See all consent enforcement cases →

Recitals That Explain This Issue

Recital 32 – Conditions for ConsentConsent needs a clear affirmative act. Silence, pre-ticked boxes and inactivity don’t count. Consent should cover every purpose.

Recital 42 – Burden of Proof and Requirements for ConsentThe controller must be able to prove consent. People must know at least the controller’s identity and the purposes. Consent isn’t free if refusing it causes detriment.

Recital 43 – Freely Given ConsentConsent is presumed not free where there is a clear imbalance, where separate purposes can’t be consented to separately, or where a service depends on unnecessary consent.

Checklist

  • Choose the legal basis for each purpose before processing starts
  • Use unticked boxes or off-by-default toggles, one per purpose
  • Keep consent separate from acceptance of terms and conditions
  • Show who you are, the purpose, the recipients and the right to withdraw at the point of consent
  • Make refusing as easy as accepting
  • Record each consent: who, when, what wording, what choice
  • Make withdrawal as easy as consent, and make sure processing actually stops
  • Check whether your service itself reveals special category data about users

Google and Grindr both had consent screens. The screens failed because they bundled purposes, hid information or gave no real option to refuse. Consent collected per purpose, logged when given and easy to withdraw is what a regulator will ask to see.

See how Secure Privacy handles this

Relevant GDPR Articles

Art. 4 GDPR Definitions
Art. 6 GDPR Lawfulness of processing
Art. 7 GDPR Conditions for consent
Art. 8 GDPR Conditions applicable to child’s consent in relation to information society services
Art. 9 GDPR Processing of special categories of personal data
Art. 22 GDPR Automated individual decision-making, including profiling
Art. 49 GDPR Derogations for specific situations

Frequently Asked Questions about GDPR Consent

+Is consent the best legal basis under GDPR?
No. It is one of six legal bases in Article 6. It fits only where the person has a genuine choice and can withdraw at any time.
+Are pre-ticked boxes valid consent?
No. Recital 32 says so, and the CJEU confirmed it in Planet49 (C-673/17).
+What happens when consent is withdrawn?
Processing based on that consent must stop. Processing carried out before withdrawal stays lawful (Art. 7(3)).
+What is explicit consent?
An express statement confirming consent, such as a written or signed confirmation. It is required for special category data, certain automated decisions and Art. 49(1)(a) transfers.
+Can I make my service conditional on consent?
Not for processing the service doesn’t need. Article 7(4) treats this as a strong sign that consent is not freely given. It was central to the Grindr decision.

External Links

Authorities

  • Data Protection Authority UK ► Consent (Link)
  • Data Protection Authority Isle of Man ► Consent (Link)
  • European Commission ► Grounds for Processing (Link)
  • European Commission ► When is consent valid? (Link)
  • ► Handbook on European data protection law – Consent, page 111 (Link)

Expert contribution

  • Lukas Zolejnik ► How to: GDPR, consent and data processing (Link)
  • IAPP ► The UX Guide to getting consent (Link)
  • Tilburg University ► Consent now and then (Link)
Scroll to Top