Consent (Article 4(11) GDPR)

Article 4(11) GDPR gives consent an independent legal definition: it is any freely given, specific, informed and unambiguous indication of the data subject's wishes in the form of a statement or another clear affirmative action by which the data subject signifies agreement to the processing of personal data relating to him or her.

1. Overview

1.1 Placement within the GDPR's structure

Consent is one of the six legal bases on which the processing of personal data may be based (Article 6(1)(a) GDPR). It permits the controller to carry out processing for which no statutory legal basis exists. It cannot, however, contract out of the GDPR's mandatory statutory requirements and cannot override a statutory prohibition.

Consent must be in place before the processing begins. Consent obtained only after the processing has commenced does not retroactively cure the processing that was unlawful up to that point.

1.2 Distinction: definition and application

Article 4(11) GDPR determines which elements an indication of wishes must satisfy in order to qualify as consent. The provision answers the question: what is consent? The follow-up questions, whether a specific consent is valid, how it must be documented and what limits it has, are governed by Articles 7 and 8 GDPR as well as by special provisions for specific situations.

2. The four definitional elements

The following table summarizes the four cumulative elements of the legal definition:

2.1 Freely given (voluntariness)

Being freely given presupposes that the data subject can choose between agreement and refusal without suffering an inappropriate detriment. Where the only way to use a service offering or to take part in a prize competition is to give consent, a genuine choice is lacking.

2.2 Specific (for the specific case)

This element excludes blanket consent intended to cover an unmanageable multitude of future processing operations. At the time of consenting, the data subject must be able to recognize what he or she is agreeing to. Where there are several processing purposes, consent must be obtained separately for each of these purposes (Recital 32 GDPR), so that the data subject can consent selectively.

2.3 Informed (in an informed manner)

Consent presupposes prior information. The data subject must at least know who the controller is, for what purpose the data are processed, whether disclosure to third parties is planned and what consequences a refusal or a withdrawal has. If this information is missing or is worded so unclearly that the data subject cannot assess its scope, there is no informed consent.

2.4 Unambiguous nature and the active act

Article 4(11) GDPR names two equivalent forms: a statement or another clear affirmative action. Recital 32 GDPR specifies that this may include, for example, ticking a box when visiting a website or choosing technical settings for information society services. What is always decisive is an active act by the data subject.

Not sufficient are silence, boxes pre-ticked before the interaction and any form of inactivity (Recital 32 GDPR). In the Planet49 case, the CJEU expressly confirmed that pre-ticked checkboxes do not constitute valid consent (CJEU, judgment of 1 October 2019, C-673/17, Planet49).

3. Burden of proof and the obligation to demonstrate

The controller must be able to demonstrate that consent meeting the requirements of Article 4(11) GDPR was given (Article 7(1) GDPR in conjunction with Article 5(2) GDPR). The burden of proof lies entirely with the controller; the data subject does not have to prove the absence of consent.

In the Orange România case, the CJEU clarified the requirements to be imposed on a pre-formulated declaration of consent and on its documentation: the circumstances of the consent process must be recorded in a comprehensible manner, so that the controller can demonstrate in the event of a dispute that the data subject actively agreed (CJEU, judgment of 11 November 2020, C-61/19, Orange România).

4. Right of withdrawal

Consent may be withdrawn by the data subject at any time, without any detriment arising for the data subject as a result (Article 7(3) GDPR). The withdrawal does not have retroactive effect; it ends the permissibility of the processing for the future. The data subject must be informed of the right to withdraw before giving consent, and it must be as easy to withdraw consent as it is to give it.

Following an effective withdrawal, there is generally a right to erasure under Article 17(1)(b) GDPR where no other legal basis supports the processing. A contractual or other exclusion of the right to withdraw is not possible.

5. Special situations

5.1 Explicit consent

For certain processing operations, the GDPR requires explicit consent that goes beyond the general requirements of Article 4(11) GDPR:

• Processing of special categories of personal data (Article 9(2)(a) GDPR)
• Automated individual decisions, including profiling (Article 22(2)(c) GDPR)
• Transfers to third countries in certain cases (Article 49(1)(a) GDPR)

5.2 Consent of children

For information society services offered to children, consent given by the child itself is valid from the completed age of 16; for younger children, the consent of the holder of parental responsibility is required (Article 8 GDPR). Member States may lower the age limit to as low as 13 years.

5.3 Employment relationship

In the employment context, special requirements apply under Section 26(2) BDSG. On account of the typical imbalance of power between employer and employee, whether consent is freely given must be examined with particular care. As a rule, consent must be obtained in written or electronic form, unless special circumstances justify a different form.

5.4 Cookies and tracking

The accessing of information stored in users' terminal equipment and the storing of such information require, under Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), consent that must meet the requirements of the GDPR. Exempted under Section 25(2) TDDDG are only those operations that are technically strictly necessary for a service expressly requested by the user.