What are the GDPR conditions for consent?

Valid GDPR consent must be freely given, specific, informed and unambiguous. These conditions mean that:

• Freely given: The person has a genuine choice, without pressure or unnecessary conditions attached to a service.

• Specific: Consent relates to clearly defined purposes, with separate choices for different purposes.

• Informed: The person understands who is collecting the data, what information is involved, why it will be used and how to withdraw consent.

• Unambiguous: Agreement is expressed through a clear affirmative action. Pre-ticked boxes, silence and inactivity do not qualify.

Consent requests must use clear language and be distinguishable from other terms. Organisations must obtain consent before starting the processing that relies on it, maintain consent records and make withdrawal of consent as easy as giving it.

For websites, cookie consent management can help present these choices and record visitors’ decisions.