Consent

Legal Framework

"'consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;"
— GDPR Art. 4(11)

This statutory definition establishes four cumulative requirements — freely given, specific, informed, and unambiguous — each of which must be independently satisfied. Article 6(1)(a) makes consent one of six possible lawful bases for processing, while Article 7 sets the operational conditions: the controller bears the burden of demonstrating consent, consent requests must be clearly distinguishable from other matters, and withdrawal must be as easy as giving consent.

"The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal."
— GDPR Art. 7(3)

Article 8 adds age-verification obligations for children's consent in information society services, setting a default threshold of 16 (with a Member State floor of 13). Article 9 elevates the standard to "explicit consent" for special categories of data. Article 13 requires disclosure of the withdrawal right at the time of data collection.

Key Developments

The CJEU has reinforced the rigor of these requirements across multiple rulings. In Planet49, the Court confirmed that consent under Article 6(1)(a) must be tied to "one or more specific purposes." In Inteligo Media, the Court emphasized that consent embedded in broader declarations must be clearly separable:

"the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language."
— Inteligo Media SA v ANSPDCP

Enforcement authorities have applied the same specificity principle on the ground. The Belgian DPA, citing EDPB guidelines, held that controllers must offer a separate opt-in for each processing purpose — bundled consent does not satisfy the granularity requirement. The DPA also stressed that withdrawal mechanisms must be as simple as the original consent act, consistent with Article 7(3).

Status of the Debate

Consent remains actively contested in court, with divergent interpretations emerging at the highest judicial level. The Schrems v Meta litigation illustrates the unresolved tension between consent, contractual necessity, and platform power — particularly when special category data under Article 9 intersects with consent-based processing:

"Mr Schrems referred to his sexual orientation for the purpose of criticising Facebook's processing of personal data, including the processing of his own data."
— Maximilian Schrems v Meta Platforms Ireland Limited

This case departs from earlier CJEU authority and signals that the conditions for freely given consent in platform ecosystems — including the intersection with special category data under Article 9 — remain unresolved at the highest level. The EDPB's April 2024 opinion on consent-or-pay models further confirms that the debate over whether genuine freedom of choice exists in these contexts is far from settled.

Practical Guidance

• Document the consent lifecycle end-to-end. Article 7(1) imposes a burden of proof on the controller — maintain records showing who consented, when, what they were told, and to what they agreed.
• Provide granular opt-in for each processing purpose. Bundled or all-or-nothing consent fails the specificity requirement confirmed by Planet49 and the Belgian DPA; offer separate toggles for each purpose.
• Ensure withdrawal is as simple as giving consent. Article 7(3) requires parity of ease — if consent is a one-click action, withdrawal must be equally accessible.
• Segregate consent requests from other terms. Inteligo Media confirms that consent buried in general terms and conditions is not validly obtained.
• Verify age and parental authorization for minors. Article 8(2) requires reasonable efforts to verify parental consent for children below the applicable age threshold, calibrated to available technology.