Where you rely on consent, it must be freely given, specific, informed and unambiguous — and as easy to withdraw as it was to give. Pre-ticked boxes and bundled consent do not count.
Key points
- You must be able to demonstrate that the person consented.
- The request must be clearly distinguishable, in plain language.
- Withdrawal must be as easy as giving consent.
Official text & source
Article 7 of the General Data Protection Regulation (Regulation (EU) 2016/679). Read the full, authoritative text on EUR-Lex.
Official text
Verbatim text of Article 7 of the General Data Protection Regulation — Regulation (EU) 2016/679.
Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
1 If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. 2 Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
1 The data subject shall have the right to withdraw his or her consent at any time. 2 The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. 3 Prior to giving consent, the data subject shall be informed thereof. 4 It shall be as easy to withdraw as to give consent.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia , the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Source: Regulation (EU) 2016/679 (OJ L 119, 4.5.2016, p. 1). Official text reproduced from EUR-Lex — © European Union. Only European Union legislation published in the Official Journal is deemed authentic.
Related articles
These summaries are a plain-English orientation only and are not a substitute for the official text of the Regulation or for legal advice.
Need to apply Article 7?
Our data-protection lawyers turn the text into a plan.