The rule.
Article 4(11) defines consent; Article 7 sets its conditions.
“‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”
“If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters …
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”
ePrivacy adds: prior consent for email marketing, with a narrow soft-opt-in exemption for existing customers on similar products.
What it requires.
Freely given. A real choice: signup must complete without marketing consent.
Specific. Separate consents per purpose — not one checkbox for email, analytics, sharing, and SMS.
Informed. State email frequency, content types, controller identity, withdrawal mechanism.
Unambiguous. Active opt-in only — pre-ticked boxes, inferred consent, browser settings fail.
Withdrawable as easily as given. One click, no login.
Common violations.
“[Checkbox] I agree to the Terms of Service, Privacy Policy, and to receive marketing emails about products and offers.”
One box for Terms, Privacy, and marketing fails specificity.
Marketing-consent checkbox pre-checked by default.
Planet49 (CJEU C-673/17): a pre-ticked box is not consent.
“To use [exchange], you must agree to receive marketing communications.”
Article 7(4) prohibits it where consent isn’t necessary for the service.
Unsubscribe link: “Sign in to manage your preferences.”
Withdrawal harder than giving. Fails Article 7(3).
How to comply.
One checkbox for terms; a separate, unchecked one for marketing.
Default state: unchecked. Non-negotiable since Planet49.
Say: “Send me product updates and offers by email. About 2–4 emails per month. You can unsubscribe with one click.”
A List-Unsubscribe header (RFC 8058) and a one-click footer link — no login, no captcha, no preference centre.
Record timestamp, source form/URL, IP, and consent-text version. Customer.io, Iterable, and Klaviyo support this natively.
Related rules.
-
Upstream of automated decision-making.
-
Email content is also governed by Article 88 for CASPs.