What does consent management mean?

Consent management refers to the systematic administration of consent. It enables companies to obtain and document consent, take it into account and allow users to withdraw it. Consent management is particularly common on websites.

What is a consent management platform (CMP)?

A consent management platform is a technical solution for managing consent decisions. It can, for example, provide cookie banners, document consent and control the activation of technologies that require consent.

Is consent management mandatory under the GDPR?

Companies must comply with the statutory requirements for consent whenever they rely on consent as the legal basis for data processing. However, the use of a specific consent management platform is not generally mandatory.

Does every website need a cookie banner?

No. A cookie banner is not required merely because a website uses cookies. What matters is whether technologies requiring consent are used. Statutory exemptions may apply to operations that are strictly necessary for the service requested by the user.

Can consent given be withdrawn at a later date?

Yes. Under Article 7(3) GDPR, consent under data protection law may be withdrawn at any time with effect for the future. Withdrawal must be as easy as giving consent.

Glossary

Consent management

Data protection glossary · 6 minutes read

Consent management refers to the administration of consent to the processing of personal data. Companies frequently use so-called consent management platforms (CMPs) to obtain, document and manage consent. Consent management is particularly relevant when cookies and tracking technologies are used on websites. The applicable legal requirements arise in particular from the General Data Protection Regulation (GDPR) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).

Consent management enables companies to systematically record users’ consent decisions and take them into account when processing data.

On websites, this is frequently implemented through a cookie banner displayed when a user visits the website for the first time.

Users are provided with information about the technologies being used and can decide which processing activities they wish to consent to.

A consent management platform performs the following tasks in particular:

Obtaining consent: Users can expressly consent to specific processing purposes.
Providing choices: Technologies requiring consent can, for example, be categorised according to statistics, personalisation and marketing.
Documenting decisions: Consents given are stored in a traceable manner.
Managing consent: Users can subsequently change their settings.
Controlling technologies: Cookies and comparable technologies requiring consent are only activated once the necessary consent has been obtained.

Effective consent management is intended to ensure that users’ decisions are actually taken into account in the technical processing of data.

Simply displaying a cookie banner is not sufficient to achieve this.

The requirements for valid consent under data protection law arise in particular from Articles 4(11) and 7 GDPR.

Accordingly, consent must be freely given, specific, informed and unambiguous.

Section 25 TDDDG is also relevant to the storing of information on terminal equipment or gaining access to information already stored on such equipment.

Unless a statutory exemption applies, consent is required for these activities.

GDPR-compliant consent management must take the following requirements into account in particular:

Freely given consent: Users must have a genuine choice and must not be unduly pressured into giving consent.
Informed decision: The purposes and essential circumstances of the processing must be explained in an understandable manner.
Active consent: Consent must be given through a clear affirmative action. Pre-ticked boxes are not sufficient.
Purpose-specific consent: Users must be able to understand which processing purposes they are consenting to.
Right to withdraw consent: Consent given must be capable of being withdrawn at any time.
Demonstrability: Companies must be able to demonstrate that valid consent has been given.

Technologies requiring consent may generally only be used once the necessary consent has been obtained.

A privacy notice or a mere notification that cookies are being used does not replace valid consent.

The GDPR does not generally require the use of a specific consent management platform.

What matters is that companies comply with the statutory requirements for obtaining, documenting and taking consent into account.

A consent management platform is particularly useful where various technologies requiring consent are used on a website.

These may include analytics and marketing services, for example.

When using such technologies, companies must assess whether consent is required under Section 25 TDDDG and, where applicable, additionally under the GDPR.

Under Section 25(2) TDDDG, consent is not required in particular where storing information or accessing information already stored is strictly necessary to provide a digital service expressly requested by the user.

Whether this exemption applies depends on the specific function and use of the technology concerned.

Even where an exemption from the consent requirement under the TDDDG applies, the GDPR requirements must still be observed if personal data is processed.

An appropriate consent management platform can help companies implement different consent decisions technically and maintain the necessary records.

Under Article 7(3) GDPR, data subjects have the right to withdraw consent given under data protection law at any time.

Withdrawing consent must be as easy as giving it.

On websites, this can be facilitated, for example, by providing a permanently accessible link to the cookie settings.

Users should be able to change their previous choices and withdraw consent they have given.

Following a valid withdrawal, processing based on that consent must not be continued for the future.

The lawfulness of processing carried out on the basis of consent before its withdrawal remains unaffected.

Companies must therefore ensure that changes to consent settings are also implemented effectively at a technical level.

A company operates a website on which, in addition to technically necessary functions, analytics and marketing technologies are to be used.

When a user first visits the website, a cookie banner appears explaining the various processing purposes.

The user can choose between consenting to the purposes offered and rejecting technologies that are not necessary.

The user initially decides to allow only technically necessary functions.

The consent management platform used by the company stores this decision and prevents analytics and marketing technologies requiring consent from being activated.

During a subsequent visit, the user additionally consents to the use of analytics technologies.

The platform documents this consent and enables the corresponding technologies to be activated.

A few days later, the user withdraws their consent through the cookie settings.

The system takes account of the withdrawal and prevents any further processing for that purpose that depends on consent.

This example illustrates how consent management supports the technical processes of obtaining, documenting and withdrawing consent.

legal data assessment: Companies should not reduce consent management to the design of a cookie banner. What matters is that users’ consent decisions are obtained in a legally valid manner, documented in a traceable way and reliably implemented at a technical level. Transparent information, genuine choices and an easily accessible withdrawal mechanism are particularly important. A consent management solution that is reviewed regularly can help prevent data protection infringements when using analytics and marketing technologies.