What is considered UK GDPR compliant consent?

UK GDPR compliant consent must be freely given, specific, informed, and unambiguous. It must also involve a clear affirmative action, meaning the person actively chooses to agree and understands what they are consenting to.

According to the ICO’s guidance on valid consent, people must have genuine choice and control. Consent requests should therefore use clear language, remain separate from unrelated terms, and offer separate choices for different purposes where appropriate.

Pre-ticked boxes, silence, inactivity, or default acceptance are not valid forms of consent. Organisations should also maintain appropriate consent records and make it as easy to withdraw consent as it was to give it.

For cookies and similar technologies, PECR determines when consent is required. Where consent is required, it must meet the relevant UK GDPR consent standard.