Consent is a freely given, specific, informed and unambiguous indication of a person's wishes by which they agree to the processing of their data.
Requirements for valid consent
- freely given, without coercion or undue pressure
- specific to one or more defined purposes
- information about the controller, the purposes and the right to withdraw
- a clear affirmative act, for example actively clicking
Silence, inactivity or pre-ticked boxes are not sufficient. The controller must be able to demonstrate that consent was given.
Withdrawal and limits
Consent can be withdrawn at any time with effect for the future, and it must be as easy to withdraw as to give. Processing carried out up to that point remains lawful.
In relationships of dependency, such as employment, whether consent is freely given must be examined particularly carefully. For information society services, children can generally only give consent themselves from the age of 16.
Legal provisions
- Art. 4(11) GDPR
- Definition of consent.
- Art. 6(1)(a) GDPR
- Consent as a legal basis.
- Art. 7 GDPR
- Conditions, evidence, withdrawal and prohibition of tying.
- Art. 8 GDPR
- Child's consent in relation to information society services.
Related terms.
Prohibition of tying (Koppelungsverbot) The prohibition of tying means that consent is generally not freely given if a contract is made conditional on consent that is not necessary for its performance. Art. 7(4) GDPR 
Consent management Consent management refers to obtaining, documenting and managing consent, typically through a consent management platform on websites and in apps. Section 25 TDDDG Legal basis for processing The legal basis is the statutory permission on which any processing of personal data must be based in order to be lawful. Art. 6(1) GDPR Legitimate interest / balancing of interests Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them. Art. 6(1)(f) GDPR
All terms from A to Z Consent management Consent management refers to obtaining, documenting and managing consent, typically through a consent management platform on websites and in apps. Section 25 TDDDG Legal basis for processing The legal basis is the statutory permission on which any processing of personal data must be based in order to be lawful. Art. 6(1) GDPR Legitimate interest / balancing of interests Legitimate interest is a legal basis under which processing is lawful if it is necessary for the purposes of legitimate interests and the interests of the data subject do not override them. Art. 6(1)(f) GDPR 