How do you collect GDPR consent?

Collect GDPR consent by giving people a clear, informed choice before starting the processing that relies on it. Under Article 7 of the GDPR, you must be able to demonstrate consent and make it as easy to withdraw as to give.

To collect valid consent:

• Explain who will use the data, what data is involved, the specific purposes and how to withdraw consent.

• Provide separate choices for distinct purposes, such as email marketing and personalised advertising.

• Require an affirmative action, such as selecting an unticked checkbox. Silence, pre-ticked boxes and simply continuing to browse are not valid consent.

• Allow people to refuse without unfair consequences. Do not make a service conditional on consent to unrelated, unnecessary processing.

• Keep evidence of when and how consent was given, what it covered and the information presented.

• Provide an accessible withdrawal method and stop the relevant consent-based processing when permission is withdrawn.

Consent is only one lawful basis; it is not required for every use of personal data. Additional rules apply when relying on consent for special-category data or offering online services directly to children.

For cookie consent, cookies and trackers requiring permission must remain inactive until the user agrees.