GDPR Art. 7 EN

Conditions for consent

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.¶

Personal Data Controllers Consent 54
2.

If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.¶

Information Provision Modalities and Communication Methods Personal Data Consent 48
3.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.¶

Personal Data Consent 45
4.

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.¶

Personal Data Processing Consent 41

Enforcement

Cited in 119 fines totalling €2.2B

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (55) · median fine €30,000 · see all enforcement for Art. 7 →

Connections by provision

7(1) 38 Case Law 16 Guidance .md

Case Law 38

Patrick BREYER v. BUNDESREPUBLIK DEUTSCHLAND, (“BREYER”) CJEU - C-582/14 - Breyer CJEU - C-61/19 - Orange Romania X v Russmedia Digital SRL and Inform Media Press SRL Agentsia po vpisvaniyata v OL European Commission v Republic of Poland RL v Landeshauptstadt Wiesbaden Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. +30 more

Guidance 16

Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Study on the secondary use of personal data in the context of scientific research EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Statement 1/2024 on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms Guidelines 05/2020 on consent under Regulation 2016/679 ¶51 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms +8 more

7(2) 29 Case Law 18 Guidance 1 Literature .md

Case Law 29

BVwG - W256 2227693-1 CJEU Bavarian Lager: Disclosing personal data in access-to-documents requests is RK v Ministerstvo zdravotnictví Ligue des droits humains ASBL v Conseil des ministres Republic of Malta v European Commission European Commission v Patrick Breyer Verein für Konsumenteninformation v Amazon EU Sàrl GC - T-496/13 - McCullough v Cedefop +21 more

Guidance 18

EDPB comments on European Commission's Guidelines on Art. 28 DSA Guidelines 05/2020 on consent under Regulation 2016/679 Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) ¶40 Guidelines 05/2020 on consent under Regulation 2016/679 ¶47 EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) +10 more

Literature 1

Training national judges for digital competition law: the DMA, private enforcement, and the infrastructure of judicial capacity

7(3) 15 Case Law 29 Guidance 1 Literature .md

Case Law 15

KPN BV v Autoriteit Consument en Markt (ACM) KHO - KHO:2026:65 BVwG - W 108 2284491-1 Safe Interenvios, SA v Liberbank, SA and Others Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums Proximus NV v Gegevensbeschermingsautoriteit Republic of Malta v European Commission ¶74 Republic of Malta v European Commission +7 more

Guidance 29

Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) Guidelines 05/2020 on consent under Regulation 2016/679 EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 03/2021 on the Proposal for a regulation of the European Parliament and of the Council on European data governance (Data Governance Act) EDPB-EDPS Joint opinion 2/2026 on the Proposal for a Regulation as regards the simplification of the digital legislative framework ( Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB Annual Report 2021 +21 more

Literature 1

Can the GPC standard eliminate consent banners in the EU?

7(4) 10 Case Law 29 Guidance 2 Literature .md

Case Law 10

OT v Vyriausioji tarnybinės etikos komisija Bundesverband der Verbraucherzentralen v Planet49 GmbH Republic of Malta v European Commission KHO - KHO:2026:65 ¶234 Ligue des droits humains ASBL v Conseil des ministres ¶79 OT v Vyriausioji tarnybinės etikos komisija ¶5 OT v Vyriausioji tarnybinės etikos komisija ¶14 Bundesverband der Verbraucherzentralen v Planet49 GmbH +2 more

Guidance 29

Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Guidelines 06/2020 on the interplay of the Second Payment Services Directive and the GDPR Guidelines 05/2020 on consent under Regulation 2016/679 Position paper on Interplay between data protection and competition law Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR) Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse +21 more

Literature 2

If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent?

Related across sources

Case Law KHO - KHO:2026:65 Case Law KHO upholds cookie consent violation ruling; no CJEU referral needed for web requests Enforcement DSB (Austria) - DSB-D124.2016/23 Enforcement Garante per la protezione dei dati personali (Italy) - 10269624 Case Law VG Osnabrück - 7 A 170/24 Enforcement ANSPDCP (Romania) - AMATO BESTSELLER S.R.L.