Consent under the GDPR

In short: Consent is voluntary, informed, unambiguous and revocable agreement to the processing of personal data for a specific purpose.

In more detail: Pre-ticked boxes or silence are not enough. The person must know who processes the data and why. Withdrawal must be as easy as giving consent. The controller must be able to prove the consent.

In Depth

• Voluntariness: A service may not be made dependent on unnecessary consent (prohibition of tying).
• Purpose limitation: Consent applies only to the stated purpose.
• Children: Online services need the child’s own consent from age 16 (in Germany), below that the parents’.
• Cookie banner: For non-essential cookies and trackers prior consent is needed (cookie consent (TDDDG)).
• Proof: who, when, which text, which version.
• When not to ask for consent: If the processing is necessary for the contract anyway, consent is the wrong basis.

See also: GDPR: principles and legal bases, Data subject rights under the GDPR