1In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation. 2Consent is presumed not to be freely given if it does not allow separate consent to be given to different personal data processing operations despite it being appropriate in the individual case, or if the performance of a contract, including the provision of a service, is dependent on the consent despite such consent not being necessary for such performance.
Title is an unofficial description, added for readability.
Consent only counts when saying no is a real option
Only with a genuine choice. GDPR Recital 43 says consent is not a valid legal basis where there is a clear imbalance of power between the person and the controller, and presumes it is not freely given when different purposes are bundled together or when a service is made conditional on consent it doesn’t actually need.
Why “presumed” is the key word
“Freely given” is the first of four conditions in the Article 4(11) definition of consent, alongside specific, informed and unambiguous. Recital 43 deals only with the first one, and it works in two different ways.
The first sentence is about the relationship: where there is a clear imbalance (the recital names public authorities as the typical example), consent is unlikely to be a valid legal ground at all. The second sentence is about the design of the consent request: bundling purposes, or making a contract or service depend on unnecessary consent, triggers a presumption that consent isn’t free. The binding rule behind that second sentence sits in Article 7(4), which requires “utmost account” to be taken of this kind of conditionality.
The burden sits with the controller
A presumption can be rebutted, but not by the data subject. Under Article 7(1) and Recital 42, the controller must be able to demonstrate valid consent. In practice that means documenting why a person could refuse without losing out, and being able to show it for every purpose you ask consent for.
The three freely-given tests
The EDPB Guidelines 05/2020 on consent break “freely given” into imbalance of power, conditionality, granularity and detriment. The first three map directly onto Recital 43:
| Test | What fails it | Where it comes from |
|---|---|---|
| Imbalance of power | Employer asking employees; public body asking citizens or pupils; a dominant platform asking users | Recital 43, sentence 1; EDPB Guidelines 05/2020, section 3.1.1; CJEU C-252/21 |
| Granularity | One “I agree” covering several purposes (e.g. service delivery plus ad sharing) | Recital 43, sentence 2; Recital 32; EDPB Guidelines 05/2020, section 3.1.3 |
| Conditionality | “Accept or you can’t use the service” for processing the service doesn’t need, including cookie walls | Recital 43, sentence 2; Article 7(4); EDPB Guidelines 05/2020, section 3.1.2 |
The fourth EDPB element, detriment (section 3.1.4), asks whether refusing or withdrawing consent leaves the person worse off. It underpins all three tests above.
What this means in practice
YesConsent is unlikely to be valid. Look at the other Article 6 bases (contract, legal obligation, public task or legitimate interest) unless refusal genuinely has no consequences
NoContinue to the next check
YesFreely given can be met, but consent must still be specific, informed and unambiguous
NoPresumed not freely given. Unbundle purposes and remove the condition before relying on consent
If you’re an employer or public bodyStart from the assumption that consent is the wrong legal basis for core processing.
- Employment records usually rest on contract, legal obligation or legitimate interest; see Article 88 and Recital 155.
- Public authorities can’t use legitimate interest for their tasks (Article 6(1), final sentence), so public task or legal obligation usually applies.
- Consent can still work for truly optional extras where saying no has no consequences at all.
If you run a website or appRecital 43 is the reason consent banners need more than one button.
- Ask separately for each purpose (analytics, advertising, personalisation) rather than one blanket “accept”.
- Don’t block access until users accept tracking. The EDPB treats cookie walls as conditional consent.
- Make withdrawal as easy as giving consent (Article 7(3)), and keep records to prove it.
Enforcement cases
These four decisions each turn on a different part of Recital 43: an employer, a public school, an app that bundled purposes, and a dominant platform. Grindr is already covered in full under Article 7, so it links there. The other three have their own case study with a timeline.
| Case | Authority / court | Date | Outcome | Recital 43 issue |
|---|---|---|---|---|
| PwC Business Solutions (HDPA 26/2019) | Hellenic DPA | Jul 2019 | €150.000 fine plus corrective orders | Imbalance: employer and employees |
| Skellefteå municipality (Sweden) | Datainspektionen (IMY) | Aug 2019 | SEK 200.000 fine; upheld on appeal | Imbalance: public authority |
| Grindr LLC (Norway) (full case under Art. 7) | Datatilsynet (Norway) | Dec 2021 | NOK 65.000.000 fine; upheld through the Court of Appeal | Bundling and conditionality |
| Meta Platforms v Bundeskartellamt (C-252/21) | CJEU (Grand Chamber) | Jul 2023 | Preliminary ruling; no fine | Imbalance: dominant platform |
All Recital 43 enforcement cases
Frequently asked questions
Can an employer rely on employee consent under GDPR?
Rarely. Regulators treat the employer-employee relationship as a clear imbalance, so employee consent is generally not considered freely given. The Greek DPA fined PwC Business Solutions €150.000 in 2019 for relying on employee consent where contract, legal obligation or legitimate interest were the correct bases. Consent can work only where refusing has no negative consequences for the employee.
Are cookie walls allowed under GDPR Recital 43?
The EDPB’s consent guidelines say no: making access to a website conditional on accepting cookies or tracking does not give the user a genuine choice, so the consent is not freely given.
Is “consent or pay” compatible with freely given consent?
For large online platforms, the EDPB said in Opinion 08/2024 that in most cases a binary choice between consenting to behavioural advertising and paying a fee will not produce valid consent. It recommends also offering a free alternative without behavioural advertising. The CJEU in C-252/21 had said users should be offered an equivalent alternative without the extra processing, if necessary for an appropriate fee.
Does a dominant market position make consent invalid?
Not automatically. In C-252/21 the CJEU held that a dominant position does not by itself prevent valid consent, but it is an important factor in deciding whether consent was freely given, and the controller must prove it was.
What does “presumed not to be freely given” mean?
If purposes are bundled into one consent or a service is made conditional on unnecessary consent, the starting assumption is that consent is invalid. The controller carries the burden of showing otherwise, because Article 7(1) requires it to be able to demonstrate valid consent.
Can you prove your consent was freely given?
Under Article 7(1), the proof is on you. Granular choices, a working “reject” option and timestamped consent records are what a regulator will ask to see.
Related provisions
Sources & further reading
- Regulation (EU) 2016/679 (GDPR), Recital 43, Articles 4(11) and 7: official text
- EDPB, Guidelines 05/2020 on consent under Regulation 2016/679: imbalance of power, conditionality, granularity, detriment, cookie walls
- CJEU, Case C-252/21, Meta Platforms and Others v Bundeskartellamt, judgment of 4 July 2023
- EDPB, Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms
- Hellenic DPA, summary of Decision 26/2019 (PwC Business Solutions)
- IMY (Swedish DPA), Facial recognition in school renders Sweden’s first GDPR fine
- Datatilsynet, The Court of Appeal upholds the fine against Grindr (21 October 2025)