What does consent mean under data protection law: consent explained
Consent is one of the six lawful bases in Article 6 GDPR, defined in Article 4(11) as a freely given, specific, informed and unambiguous indication of a person's wishes, made by a statement or a clear affirmative action. It can be withdrawn at any time, as easily as it was given.
Read the definition as four separate tests rather than one. Consent fails if any single one of them fails, and in practice the one that fails is almost always "freely given".
What makes consent valid?
- Freely given. There has to be a real choice, with no detriment for refusing. Article 7(4) says that when assessing this, utmost account is taken of whether performance of a contract is made conditional on consent to processing that is not necessary for that contract.
- Specific. One consent per purpose. Bundling assessment, marketing and analytics into a single tick invalidates all three.
- Informed. The person knows who the controller is, what will happen to the data, and that they can withdraw.
- Unambiguous. A clear affirmative action. Pre-ticked boxes, silence and continued use of a service do not count.
- Demonstrable. Article 7(1) puts the burden on you to show consent was given, which means keeping a record of who consented, when, to what wording.
Why consent is often the wrong basis for a business process
Article 7(3) is the clause that decides it. Consent can be withdrawn at any time, withdrawal must be as easy as giving it, and the process has to be able to stop. If your workflow would break, or if you would carry on processing anyway under some other justification, then the consent you collected was decoration.
Power imbalance is the second trap. The EDPB's Guidelines 05/2020 on consent state that given the imbalance between an employer and its staff, employees can only give free consent in exceptional circumstances where refusal carries no adverse consequence, and that public authorities usually have more appropriate bases available. The same logic reaches a customer who needs a claim settled or a repair authorised.
When contract or legitimate interests fit better
- Contract, Article 6(1)(b). Use it when the processing is necessary to deliver what the person asked for, including pre-contract steps at their request. Collecting damage photos to assess a claim under a policy is contract, not consent.
- Legitimate interests, Article 6(1)(f). Use it for necessary operational processing the person would reasonably expect, such as fraud prevention or securing a system, backed by a documented balancing test.
- Legal obligation, Article 6(1)(c). Use it where a statute or regulator requires the processing, such as regulated record keeping.
Consent earns its place where the processing is genuinely optional and the person can walk away with nothing lost. Marketing is the classic fit. So is reusing customer footage in a case study.
Consent explained: a practical example
A service department asks a customer to record a short video of a fault before booking a slot, a common step in guided photo capture workflows. Using that video to diagnose and quote is a pre-contract step taken at the customer's request, so contract is the cleaner lawful basis. Reusing the same clip in a training library or an advert is a different purpose entirely, and that one needs separate consent the customer can refuse without losing the appointment.
How consent differs from things that look like it
A signature on a form is evidence that something was presented, not proof that consent met the Article 4(11) standard. A cookie banner is answering a different rule, the ePrivacy requirements implemented in the UK by PECR, which demand consent for storing or reading information on a device regardless of which Article 6 basis covers the data afterwards. Explicit consent under Article 9(2)(a), used for special category personal data, is a higher bar again and needs an express statement rather than an inferred action.
One more distinction worth holding onto: consent to processing is not the same as consent under other law, such as rules on recording conversations or filming on private property. Those obligations run in parallel and are not satisfied by a privacy tick box.
What consent means for your inbox
Whatever basis you pick, people can ask what you hold and why. Consent records, withdrawal timestamps and the wording shown at the time all form part of what you may have to produce in response to a data subject request. The UK operates its own version of these rules under the UK GDPR and the Data Protection Act 2018, and other jurisdictions set the bar differently again, with several US state laws requiring opt in only for sensitive categories. Check the regime you are actually in before copying an EU consent flow across borders.