GDPR Q10

What is valid consent under GDPR?

Q10. What is valid consent under GDPR?

Category: Consent

Consent under GDPR must be a real choice. People should understand what they are agreeing to and be able to withdraw at any time without penalty.

In simple terms

Consent must be freely given, specific, informed, and unambiguous.
It requires a clear positive action—no pre-ticked boxes.
Withdrawal must be as easy as giving consent.

When consent is appropriate

Use consent when individuals are genuinely in control and can say no without negative consequences. It is ideal for optional services like marketing or cookies that are not strictly necessary.

Avoid consent if you cannot offer an alternative service.
Consider other lawful bases like legitimate interests or legal obligation when appropriate.
Keep consent separate from general terms and conditions.

Designing a consent request

Consent requests should be clear and specific. Tell people exactly what you will use their data for, who you will share it with, and how long you will keep it.

Use plain language that a child can understand.
Offer granular choices (for example, separate email and SMS marketing).
Record when, how, and what individuals were told at the time.

Managing consent

Keep a consent register and review it regularly. If you change the purpose or want to introduce new processing, ask for consent again.

Provide self-service preference centres where possible.
Withdrawn consent must be actioned promptly across all systems.
Keep evidence showing how you responded to withdrawals.

Practical steps to take

Identify the processing activities where consent is the right lawful basis.
Draft clear consent wording and test it with real users for comprehension.
Capture consent records in a central system along with timestamps.
Set up automated workflows to honour withdrawals quickly.
Review consent at least every two years to ensure it remains valid.

Real-life examples

Newsletter signup

A charity collects email addresses with a tick box that clearly states newsletters are optional. People can unsubscribe using a link in every email.

Event photography

An event organiser asks participants whether their photo can be used in marketing materials. The consent form explains how images will be used and allows people to opt out.

Helpful reminders

Consent is not valid if there is any element of pressure or imbalance.
Silence or inactivity cannot be treated as consent.
Parental consent is required for children under 13 in the UK for online services relying on consent.
Keep your privacy notice aligned with the consent wording.

Key takeaway

Make consent a genuine, informed choice and maintain evidence—it builds trust and keeps you compliant.