"I consent to the processing of my personal data": the box appears everywhere, from sign-up forms to apps to sheets signed at the doctor's or the gym. Many people think that without that signature nobody can use their data, and that with it anything is allowed. Both ideas are wrong. Understanding the real role of consent helps you recognise when it is needed and when it is being asked for for no reason.
Consent is one of six legal bases
Article 6 of Regulation (EU) 2016/679 lists six alternative legal bases that make processing lawful:
- the data subject's consent;
- the performance of a contract to which you are a party, or pre-contractual steps you requested;
- a legal obligation of the controller;
- protecting the vital interests of you or another person;
- performing a task in the public interest or in the exercise of official authority;
- the legitimate interests of the controller or a third party, provided your interests and rights do not override them.
This means that a great deal of processing does not require consent. The online shop that uses your address to send you a parcel relies on the contract; the employer that passes your data to the social security body is complying with a legal obligation. Asking for consent in these cases is pointless and may even cause confusion, because it suggests you could withdraw it.
When consent is needed
Consent becomes the typical basis for processing that is not essential to the service you requested and does not fit another basis:
- sending promotional communications, in many cases;
- passing data to third parties for their own marketing purposes;
- non-essential cookies and tracking tools;
- some processing of special categories of data, such as health data, for which Article 9 requires explicit consent when no other exception applies.
What makes consent valid
Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of wishes, given by a statement or a clear affirmative action. Article 7 adds some conditions.
| Requirement | What it means | Example of a breach |
|---|---|---|
| Freely given | You can refuse without unjustified consequences | Service refused unless you accept marketing, when marketing is not needed for the service |
| Specific | One consent for each distinct purpose | A single box for newsletter, profiling and sharing with third parties |
| Informed | You know who processes the data and why | Consent requested without a privacy notice |
| Unambiguous | An affirmative action is needed | Pre-ticked boxes, silence, inactivity |
| Distinguishable | If part of a wider document, it must be separate from the rest | Consent buried in the general terms of contract |
| Demonstrable | The controller must be able to prove it obtained it | No record of when and how it was given |
Article 7(4) is particularly important: when assessing whether consent is freely given, account is taken of whether performance of a contract is made conditional on consent to processing that is not necessary for that contract.
Withdrawal: as easy as giving consent
Article 7(3) states that you can withdraw consent at any time and that withdrawing must be as easy as giving it. If you consented with a click in an app, you cannot be required to send a registered letter to withdraw.
How to withdraw
- Look for the tool provided: account settings, preference centre, link at the bottom of emails.
- If there is none, write to the controller giving the details that identify you and the purposes for which you are withdrawing consent.
- Be specific or general depending on your goal: you can withdraw only marketing consent and keep, for example, consent to notices about new services, or withdraw every consent given.
- Keep proof of the withdrawal.
What happens next
- Processing based on consent must stop.
- Processing carried out before the withdrawal remains lawful: withdrawal is not retroactive.
- If there is no other legal basis, you can also request erasure of the data under Article 17.
- The controller cannot simply "switch" the processing to another legal basis because you withdrew consent, if it originally chose consent as the basis.
A concrete example
You join a chain store's loyalty programme. The form has three boxes: programme rules (mandatory), promotional communications (optional), sharing data with partners (optional). This is a correct set-up: the purposes are separate and you can join the programme without accepting the rest. If after a few months the offers become excessive, you can withdraw the second consent from the app, as easily as you gave it, and keep collecting points.
In short
- Consent is only one of the six legal bases in Article 6 GDPR: much processing does not require it.
- It is needed mainly for marketing, sharing with third parties, non-essential cookies and some sensitive data.
- It must be freely given, specific, informed, unambiguous and separate from other content.
- You can withdraw it at any time, as easily as you gave it.
- Withdrawal is not retroactive, but it stops the processing and opens the way to erasure.