Consent

Consent is a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject agrees to the processing of personal data relating to them. It may be expressed in a statement or by a clear affirmative action. Silence, inactivity and pre-ticked boxes do not amount to active consent.

The information must be understandable and linked to a specific purpose. Where data are to be processed for several separate purposes, those purposes should be presented distinctly. Consent is not required merely because personal data are being processed: the business must first identify the legal basis that fits the actual purpose and operation. Cookies, direct marketing, profiling and similar activities require particular care with purpose descriptions and technical implementation.

The controller must be able to demonstrate that consent was given. A data subject may withdraw consent at any time, and withdrawing it must be as easy as giving it. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. After withdrawal, the relevant processing should generally stop unless a separate legal basis has been independently established for the same purpose.

In practice, record the purpose, data categories, information notice, time, version and method of consent. Also document how withdrawals are received and implemented. The section on marketing, cookies and tracking places common consent situations in context. Related terms include legal basis and legitimate interests.