GDPR Art. 7 EN

Conditions for consent

In force — consolidated2016-05-04 · CELEX 02016R0679-20160504 · ELI ↗

Version history 2

2016-05-04in force CELEX 02016R0679-20160504
2016-04-27 CELEX 32016R0679

1.

Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.¶

Personal Data Controllers Consent 34
2.

If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.¶

Personal Data Consent Information Provision Modalities and Communication Methods 27
3.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.¶

Personal Data Consent 27
4.

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.¶

Personal Data Consent Processing 29

Enforcement

Cited in 115 fines totalling €2.1B

Top authority: 🇪🇺Italian Data Protection Authority (Garante) (55) · median fine €30,000 · see all enforcement for Art. 7 →

Connections by provision

7(1) 24 Case Law 10 Guidance .md

Case Law 24

CJEU - C-61/19 - Orange Romania Patrick BREYER v. BUNDESREPUBLIK DEUTSCHLAND, (“BREYER”) Judgment of the Court (Grand Chamber) of 2 December 2025.#X v Russmedia Digital SRL and Inform Media Press SRL.#Request for a preliminary ruling from the Curtea de Apel Cluj.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 4(7) – Concept of ‘controller’ – Responsibility of the operator of an online marketplace for the publication of personal data contained in advertisements placed on its online marketplace by user advertisers – Article 5(2) – Judgment of the Court (Grand Chamber), 16 October 2012.#European Commission v Republic of Austria.#Failure of a Member State to fulfil obligations – Directive 95/46/EC – Processing of personal data and free movement of such data – Protection of natural persons – Article 28(1) – National supervisory authority – Independence – Supervisory authority and the Federal Chancellery – Personal and organisational links.#Case C‑614/10. Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14. Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment Judgment of the General Court (Fifth Chamber, Extended Composition) of 25 September 2018.#Maria Psara and Others v European Parliament.#Access to documents — Regulation (EC) No 1049/2001 — European Parliament — Expenditure by Members of the Parliament of their allowances — Refusal to grant access — Non-existent documents — Personal data — Regulation (EC) No 45/2001 — Need to transfer the data — Specific and individual examination — Partial access — Excessive administrative burden — Obligation to Judgment of the Court (Third Chamber) of 11 December 2019.#TK v Asociaţia de Proprietari bloc M5A-ScaraA.#Request for a preliminary ruling from the Tribunalul Bucureşti.#Reference for a preliminary ruling — Protection of individuals with regard to the processing of personal data — Charter of Fundamental Rights of the European Union — Articles 7 and 8 — Directive 95/46/EC — Article 6(1)(c) and Article 7(f) — Making the processing of personal data legitimate — National legislation allowing video s +16 more

Guidance 10

EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Statement 1/2024 on legislative developments regarding the Proposal for a Regulation laying down rules to prevent and combat child sexual abuse Guidelines 05/2020 on consent under Regulation 2016/679 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation ¶171 Guidelines 05/2020 on consent under Regulation 2016/679 ¶104 Guidelines 05/2020 on consent under Regulation 2016/679 +2 more

7(2) 18 Case Law 8 Guidance 1 Literature .md

Case Law 18

Judgment of the Court (Eighth Chamber) of 5 October 2023.#RK v Ministerstvo zdravotnictví.#Request for a preliminary ruling from the Nejvyšší správní soud.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Regulation (EU) 2016/679 – Article 4(2) – Concept of ‘processing’ of personal data – Mobile application – Verification of the validity of ‘EU Digital COVID Certificates’ issued pursuant to Regulation (EU) 2021/953.#Case C-659/22 FTT: NMC should have neither confirmed nor denied holding struck-off nurse's personal data COMMISSION V. BAVARIAN LAGER CO., 29.Jun.2010 (“BAVARIAN LAGER”) Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment Judgment of the Court (Grand Chamber) of 18 July 2017.#European Commission v Patrick Breyer.#Appeal — Access to documents of the institutions — Article 15(3) TFEU — Regulation (EC) No 1049/2001 — Scope — Application for access to written submissions filed by the Republic of Austria in the case in which judgment was given on 29 July 2010, Commission v Austria (C‑189/09, not published, EU:C:2010:455) — Documents in the possession of the European Commission — Protection of court proceedings.#Case C Judgment of the Court (Third Chamber) of 28 July 2016.#Verein für Konsumenteninformation v Amazon EU Sàrl.#Request for a preliminary ruling from the Oberster Gerichtshof.#Reference for a preliminary ruling — Judicial cooperation in civil matters — Regulations (EC) No 864/2007 and (EC) No 593/2008 — Consumer protection — Directive 93/13/EEC — Data protection — Directive 95/46/EC — Online sales contracts concluded with consumers resident in other Member States — Unfair terms — General terms and co GC - T-496/13 - McCullough v Cedefop +10 more

Guidance 8

EDPB comments on European Commission's Guidelines on Art. 28 DSA Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation EDPB-EDPS Joint Opinion 2/2022 on the Proposal of the European Parliament and of the Council on harmonised rules on fair access to and use of data (Data Act) Guidelines 05/2020 on consent under Regulation 2016/679 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms ¶71 Guidelines 05/2020 on consent under Regulation 2016/679 ¶66 Guidelines 05/2020 on consent under Regulation 2016/679 ¶171 Guidelines 05/2020 on consent under Regulation 2016/679

Literature 1

Training national judges for digital competition law: the DMA, private enforcement, and the infrastructure of judicial capacity

7(3) 14 Case Law 12 Guidance 1 Literature .md

Case Law 14

Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment BVwG - W 108 2284491-1 Judgment of the Court (Fourth Chamber) of 27 October 2022.#Proximus NV v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories and of directory enquiry serv Judgment of the Court (Third Chamber) of 17 September 2015.#KPN BV v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Universal service and users’ rights — Directive 2002/22/EC — Article 28 — Access to numbers and to services — Non-geographic numbers — Directive 2002/19/EC — Articles 5, 8 and 13 — Powers of the national regulatory authori Judgment of the Court (First Chamber) of 30 March 2023.#Hauptpersonalrat der Lehrerinnen und Lehrer beim Hessischen Kultusministerium v Minister des Hessischen Kultusministeriums.#Request for a preliminary ruling from the Verwaltungsgericht Wiesbaden.#Reference for a preliminary ruling – Protection of personal data – Regulation (EU) 2016/679 – Article 88(1) and (2) – Processing of data in the employment context – Regional school system – Teaching by videoconference due to the COVID-19 pandemic – Judgment of the Court (Fifth Chamber) of 10 March 2016.#Safe Interenvios, SA v Liberbank, SA and Others.#Request for a preliminary ruling from the Audiencia Provincial de Barcelona.#Reference for a preliminary ruling — Prevention of the use of the financial system for the purpose of money laundering and terrorist financing — Directive 2005/60/EC — Customer due diligence measures — Directive 2007/64/EC — Payment services in the internal market.#Case C-235/14. ¶6 Judgment of the Court (Third Chamber) of 17 September 2015.#KPN BV v Autoriteit Consument en Markt (ACM).#Request for a preliminary ruling from the College van Beroep voor het Bedrijfsleven.#Reference for a preliminary ruling — Electronic communications networks and services — Universal service and users’ rights — Directive 2002/22/EC — Article 28 — Access to numbers and to services — Non-geographic numbers — Directive 2002/19/EC — Articles 5, 8 and 13 — Powers of the national regulatory authori ¶78 Judgment of the Court (Fourth Chamber) of 27 October 2022.#Proximus NV v Gegevensbeschermingsautoriteit.#Request for a preliminary ruling from the Hof van beroep te Brussel.#Reference for a preliminary ruling – Processing of personal data and protection of privacy in the electronic communications sector – Directive 2002/58/EC – Article 12 – Public telephone directories and directory enquiry services – Subscriber’s consent – Obligations of the provider of directories and of directory enquiry serv +6 more

Guidance 12

Guidelines 05/2020 on consent under Regulation 2016/679 Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse EDPB Annual Report 2021 Opinion 3/2019 concerning the Questions and Answers on the interplay between the Clinical Trials Regulation (CTR) and the General Data Protection regulation (GDPR) Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation ¶116 Guidelines 05/2020 on consent under Regulation 2016/679 ¶149 Guidelines 05/2020 on consent under Regulation 2016/679 +4 more

Literature 1

Can the GPC standard eliminate consent banners in the EU?

7(4) 9 Case Law 18 Guidance 2 Literature .md

Case Law 9

Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment Bundesverband der Verbraucherzentralen v Planet49 GmbH Judgment of the Court (Grand Chamber) of 1 August 2022.#OT v Vyriausioji tarnybinės etikos komisija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of ¶234 Judgment of the Court (Grand Chamber) of 21 June 2022.#Ligue des droits humains ASBL v Conseil des ministres.#Request for a preliminary ruling from the Cour constitutionnelle.#Reference for a preliminary ruling – Processing of personal data – Passenger Name Record (PNR) data – Regulation (EU) 2016/679 – Article 2(2)(d) – Scope – Directive (EU) 2016/681 – Use of PNR data of air passengers of flights operated between the European Union and third countries – Power to include data of air passengers ¶14 Bundesverband der Verbraucherzentralen v Planet49 GmbH ¶64 Bundesverband der Verbraucherzentralen v Planet49 GmbH ¶79 Judgment of the Court (Grand Chamber) of 1 August 2022.#OT v Vyriausioji tarnybinės etikos komisija.#Request for a preliminary ruling from the Vilniaus apygardos administracinis teismas.#Reference for a preliminary ruling – Protection of natural persons with regard to the processing of personal data – Charter of Fundamental Rights of the European Union – Articles 7, 8 and 52(1) – Directive 95/46/EC – Article 7(c) – Article 8(1) – Regulation (EU) 2016/679 – Point (c) of the first subparagraph of ¶74 Judgment of the General Court (Ninth Chamber) of 3 May 2018.#Republic of Malta v European Commission.#Access to documents — Regulation (EC) No 1049/2001 — Documents held by the Commission — Documents originating from a Member State — Documents exchanged pursuant to the control system for ensuring compliance with the rules of the common fisheries policy — Article 113 of Regulation (EC) No 1224/2009 — Public access following a request made by a non-governmental organisation — Action for annulment +1 more

Guidance 18

Opinion 11/2024 on the use of facial recognition to streamline airport passengers’ flow (compatibility with Articles 5(1)(e) and(f), 25 and 32 GDPR) Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms EDPB-EDPS Joint Opinion 02/2023 on the Proposal for a Regulation of the European Parliament and of the Council on the establishment of the digital euro EDPB-EDPS Joint Opinion 04/2022 on the Proposal for a Regulation of the European Parliament and of the Council laying down rules to prevent and combat child sexual abuse Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation Statement 03/2021 on the ePrivacy Regulation Guidelines 05/2020 on consent under Regulation 2016/679 Guidelines 2/2019 on the processing of personal data under Article 6(1)(b) GDPR in the context of the provision of online services to data subjects +10 more

Literature 2

Pay or Consent Models in Europe: Already Outdated or an Overlooked Crisis in Freely Given Consent? If it ain’t broke, don’t fix it? Ten improvements for the upcoming tenth anniversary of the General Data Protection Regulation

Related across sources

Case Law TSJ PV: Accidental Teams recordings after meetings ended cannot justify trust-based Case Law EWCA - Dawson-Damer v Taylor Wessing LLP Enforcement CNIL fines energy supplier for mishandling data subject access and objection requests Enforcement AEPD investigates University of Navarra over student COVID-19 vaccination status requests Enforcement Italian Garante sanctions Calabrian agency for location tracking of remote workers Case Law CJEU - C-673/17 - Planet49