When consent actually counts
A click on "Accept" is not yet consent. Four conditions have to come together, and any one of them can render an otherwise properly collected agreement worthless.
The GDPR describes consent as a "freely given, specific, informed and unambiguous indication of wishes". The sentence is unwieldy, but it holds four clearly testable requirements.
Four conditions, all of which must hold
- Freely givenA real choice has to exist. Refusing must not bring any disadvantage beyond doing without the feature in question.
- SpecificSeparate per purpose. A blanket agreement to statistics, advertising and personalisation in one click is invalid.
- InformedWho processes, for what, for how long, and who else receives the data – readable before the click.
- UnambiguousAn active step. Scrolling on, clicking through or a pre-ticked box are not enough.
Freely given is the hardest condition
Consent is not freely given where refusal is noticeably punished. That covers not only open pressure but also the prohibition on bundling: a service must generally not be made conditional on consent to processing that the service does not require.
A second case concerns an imbalance between the parties. Between employer and staff, or authority and citizen, freely given consent is conceivable only in special circumstances.
Test question for freely given consent
What does not make consent valid
- A note in the privacy policy. Information is a precondition of consent, not a substitute for it.
- Continued use of the site. A line like "by continuing to browse you agree" describes a fiction, not an indication of wishes.
- A pre-set toggle. Defaults are the opposite of an active step – as the Court of Justice held in Planet 49.
- A click that takes effect beforehand. If scripts load before the decision, consent arrives too late, whatever it says.
Notably, none of these conditions is technically difficult. They cost click rates, not development time – and therein lies the real reason so many banners miss the mark.