Consent (Articles 6 + 7 GDPR)
One of 6 legal bases — strict requirements
TL;DR
Consent under Art. 4(11) GDPR is any freely given, specific, informed and unambiguous indication of wishes given in the form of a statement or a clear affirmative action. It is one of 6 legal bases under Art. 6 — the mandatory elements are: freely given, specific, informed, unambiguous, and withdrawable at any time (Art. 7).
What is consent (Articles 6 + 7 GDPR)?
The four mandatory elements of valid consent:
- Freely given — no situation of constraint, no bundling with performance of a contract (Art. 7(4))
- Specific — separately for each purpose
- Informed — about the purpose, recipients, withdrawal, fine
- Unambiguous — an active action (no opt-out, no pre-ticked box)
Practical example
CJEU C-673/17 (Planet49): pre-ticked cookie boxes are invalid. CJEU C-604/22 (IAB Europe, 03/2024): targeting without genuine consent is prohibited. Current practice: a cookie banner compliant with the German Telecommunications-Digital-Services Data Protection Act (TDDDG) offering a genuine choice.
Frequently asked questions
When is consent NOT the right legal basis?
In the employment relationship (constraint), for performance of a contract (Art. 6(1)(b) is more appropriate), and for legitimate interests (point (f)).
How do I document consent?
A consent management tool with an audit trail. Time, wording, IP address (pseudonymised), time of withdrawal.
What happens on withdrawal?
Processing must stop immediately. Delete the data unless another legal basis applies. Send confirmation to the data subject.
See also
Practitioner note: This article is practice-oriented compliance documentation, not legal advice. We are compliance specialists, not a law firm. For legally binding advice, consult an admitted lawyer.