Consent is one of the legal bases for the processing of personal data under the General Data Protection Regulation (GDPR). It allows data subjects to decide for themselves whether their personal data may be processed for specific purposes. For consent to be valid, it must be freely given, informed, specific and expressed through an unambiguous affirmative action. The relevant legal provisions are set out in particular in Article 4(11), Article 6(1)(a) and Article 7 GDPR.
What requirements must valid consent meet?
Under Article 4(11) GDPR, consent means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them.
For consent to be valid, the following requirements must be met in particular:
- Freely given: The data subject must have a genuine choice and be able to refuse consent without undue pressure or significant disadvantages.
- Specific: Consent must relate to one or more clearly defined purposes of processing. Blanket declarations covering unspecified future processing activities are generally insufficient.
- Informed: Before giving consent, the data subject must be provided with clear and understandable information about the essential circumstances of the data processing.
- Unambiguous indication of wishes: Consent must be given by means of a statement or another clear affirmative action. Silence, inactivity or pre-ticked boxes do not constitute valid consent.
- Withdrawable: The data subject must be able to withdraw their consent at any time with effect for the future.
If personal data is processed for several different purposes, the data subject must be able to make a correspondingly differentiated choice.
Consent must also be clearly distinguishable from other declarations if it is requested alongside other matters. Under Article 7(2) GDPR, it must be presented in an intelligible and easily accessible form, using clear and plain language.
Additional requirements apply to the processing of special categories of personal data under Article 9 GDPR. Where such processing is based on consent, that consent must generally be explicit under Article 9(2)(a) GDPR.
When is consent required, and what does the prohibition on tying mean?
Consent is not required for every instance of personal data processing. Article 6(1) GDPR provides for several possible legal bases.
For example, personal data may also be processed where this is necessary for the performance of a contract, compliance with a legal obligation or, subject to the statutory requirements, the purposes of legitimate interests.
Consent may be appropriate in particular where no other suitable legal basis exists for the intended processing or where the processing is deliberately made dependent on the data subject's free choice.
Typical examples include voluntary subscriptions to marketing newsletters or certain tracking and marketing activities that require consent.
The so-called prohibition on tying (Kopplungsverbot) is particularly important. Under Article 7(4) GDPR, when assessing whether consent has been freely given, particular account must be taken of whether the performance of a contract is made conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
A company must therefore not make a service conditional on voluntary consent without further justification where the relevant data processing is not necessary for that service.
However, not every link between consent and a service automatically renders consent invalid. The specific circumstances and whether the data subject is genuinely able to make a free choice are decisive.
The storage of information on terminal equipment or access to information already stored on such equipment is also subject to the specific requirements of Section 25 TDDDG (German Telecommunications Digital Services Data Protection Act). Where consent is required, its validity is assessed in accordance with the GDPR standards.
How must consent be obtained and documented?
As a general rule, consent may be given in writing, electronically or through another clear affirmative action. The GDPR does not generally prescribe a specific form.
What matters is that consent meets the statutory requirements and that the controller can demonstrate that it was given.
Under Article 7(1) GDPR, the controller must be able to demonstrate that the data subject has consented to the processing of their personal data.
For the purposes of transparent documentation, the following information may be recorded in particular:
- the identity of the person giving consent or a clear means of identifying that person;
- the date and method by which consent was given;
- the specific purposes of the data processing;
- the content of the information provided at the time consent was given;
- the consent declaration used, or the relevant version of that declaration.
For electronic consent, suitable technical procedures may be used to document the granting of consent in a traceable manner.
The double opt-in procedure is frequently used for newsletter subscriptions, for example. After signing up, the data subject receives a confirmation message through which they expressly confirm their subscription.
However, double opt-in is not a general statutory requirement for every consent under data protection law. In particular, it can help demonstrate who gave electronic consent and that it was actually granted.
Companies must also ensure that information is provided in an understandable way and that consent is not obtained through misleading design or preselected options.
How can consent be withdrawn, and what are the consequences of withdrawal?
Under Article 7(3) GDPR, data subjects may withdraw their consent at any time.
Withdrawal must be as easy as giving consent. Companies must therefore not make withdrawal unnecessarily difficult by imposing avoidable obstacles.
For example, if consent was given through an easily accessible online function, a similarly straightforward method must also be available for withdrawing it.
Withdrawal generally takes effect for the future. It does not affect the lawfulness of processing carried out on the basis of valid consent before the withdrawal.
Once consent has been validly withdrawn, the relevant processing may no longer be based on that consent. If no other applicable legal basis exists, the processing for the relevant purpose must cease.
Subject to the requirements of Article 17 GDPR, the personal data must also be erased. Statutory retention obligations or other legal grounds may prevent complete erasure.
Companies cannot simply rely on another legal basis retrospectively in order to continue unchanged processing that was originally based exclusively on consent despite its withdrawal.
Data subjects must be informed of their right to withdraw consent before giving it.
What specific requirements apply to children and in the employment context?
Consent given by children and employees is subject to specific requirements because the freedom to consent and the ability to give valid consent must be carefully assessed.
Consent given by children
Article 8 GDPR contains specific rules on consent given by children in relation to information society services offered directly to a child, where the processing is based on Article 6(1)(a) GDPR.
In Germany, the applicable age threshold is generally 16. For younger children, processing is lawful under the conditions set out in Article 8 GDPR only if consent is given or authorised by the holder of parental responsibility.
The age threshold under Article 8 GDPR does not apply across the board to all processing of minors' personal data. Outside its scope, the relevant legal requirements must be assessed separately.
Consent in the employment context
In an employment relationship, the voluntary nature of consent requires particularly careful assessment. The relationship of dependence between employers and employees may restrict the employee's freedom to make a decision.
Consent is therefore not valid merely because it has been expressly given. What matters is whether the employee is genuinely free to decide and does not have to fear undue disadvantages if they refuse.
The relevant requirements arise in particular from Articles 4(11) and 7 GDPR. Additional national provisions, especially Section 26 BDSG (German Federal Data Protection Act), must also be assessed in light of EU law requirements and the relevant case law.
Companies should therefore carefully determine, particularly when processing employee data, whether consent is the appropriate legal basis or whether the processing must instead rely on another statutory ground.
Practical example: Consent when subscribing to a newsletter
An online shop wants to send its customers regular newsletters featuring product offers and special discounts.
To do so, the company provides a separate subscription form on its website. Interested individuals can voluntarily enter their email address and are given clear information before subscribing about the purpose of the data processing and their right to withdraw consent at any time.
The online shop uses a double opt-in procedure to document the subscription. The email address is only activated for newsletter distribution once the individual has clicked the relevant confirmation link.
Subscribing to the newsletter is not a condition for making a purchase from the online shop. Customers can therefore place orders without giving the relevant consent.
Each newsletter also contains an easily accessible unsubscribe option. Once consent has been withdrawn, the company stops sending marketing emails on the basis of that consent.
legal data assessment: Valid consent requires data subjects to be able to make a genuine and informed choice. Companies should therefore formulate consent declarations clearly, separate different processing purposes from one another and document the granting of consent in a traceable manner. An easy withdrawal process is equally important. Carefully designed consent procedures reduce the risk of invalid declarations and unlawful data processing.
Legal bases
Article 4(11) GDPR; Article 5(2) GDPR; Article 6(1)(a) GDPR; Articles 7 and 8 GDPR; Article 9(2)(a) GDPR; Article 17 GDPR; Article 88 GDPR; Section 26 BDSG; Section 25 TDDDG.
Frequently asked questions about consent
What is consent under the GDPR?
Consent is a freely given, informed, specific and unambiguous indication of agreement to the processing of personal data. The legal definition is set out in Article 4(11) GDPR.
Does consent always have to be given in writing?
No. As a general rule, consent may also be given electronically or through another clear affirmative action. What matters is that it is validly given and that the controller can demonstrate that it was granted. Additional requirements apply to certain types of processing.
Is consent required for every instance of personal data processing?
No. In addition to consent, the GDPR provides for other legal bases. These include, for example, processing necessary for the performance of a contract, compliance with legal obligations and legitimate interests, subject to the applicable statutory requirements.
Can consent be withdrawn at any time?
Yes. Under Article 7(3) GDPR, data subjects may withdraw their consent at any time with effect for the future. Withdrawal must be as easy as giving consent.
At what age can children give their own consent to data processing?
For information society services offered directly to children, the age threshold in Germany is generally 16 within the scope of Article 8 GDPR. For younger children, consent or authorisation by the holder of parental responsibility is required under the statutory conditions. This rule does not apply across the board to all processing of minors' personal data.
Related terms.
Consent management Consent management refers to the administration of consent to the processing of personal data. Companies frequently use so-called consent management platforms (CMPs) to obtain, document and manage consent. Consent management is particularly relevant when cookies and tracking technologies are used on websites. The applicable legal requirements arise in particular from the General Data Protection Regulation (GDPR) and Section 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG). Legal basis for processing The legal basis is the statutory permission on which any processing of personal data must be based in order to be lawful. Art. 6(1) GDPR Legitimate interest / balancing of interests Legitimate interests constitute a legal basis for the processing of personal data under Article 6(1)(f) GDPR. Companies may process personal data on this basis if the processing is necessary for the purposes of the legitimate interests pursued and those interests are not overridden by the interests or fundamental rights and freedoms of the data subjects. Whether these conditions are met must be assessed as part of a balancing test. Where this legal basis applies, consent is generally not required. 