Under the GDPR, what four conditions make consent valid, and why does a pre-ticked box fail them?
answer
- four adjectives in one definition
- a clear affirmative act
- silence and inactivity do not count
- Art. 4(11) and Recital 32
basics
~20 sGDPR Art. 4(11) requires consent to be freely given, specific, informed and unambiguous, expressed by a statement or clear affirmative action. A pre-ticked box records the controller's choice, not the person's act, so Recital 32 excludes it.
solid answer
~40 sUnder the GDPR, `Art. 4(11)` defines consent as a **freely given, specific, informed and unambiguous** indication of the data subject's wishes, given *by a statement or by a clear affirmative action*. **Freely given** means a genuine choice, refusable without detriment (Recital 42). **Specific** means tied to one or more stated purposes, with separate consents where purposes differ. **Informed** means the person knows at least who the controller is and what the purposes are (Recital 42), and EDPB Guidelines 05/2020 add the data involved and the right to withdraw. **Unambiguous** means an active step that cannot be read another way. A pre-ticked box fails the last condition: the person did nothing, and Recital 32 says *silence, pre-ticked boxes or inactivity should not* constitute consent. The CJEU confirmed this for cookie checkboxes in Planet49 (case C-673/17).
go deeper
Recall the four conditions from Art. 4(11) and that Recital 32 rules out silence, pre-ticked boxes and inactivity.
Explain what each condition requires in practice, including the EDPB's minimum information list and why scrolling fails the affirmative-action test.
Audit a real consent flow condition by condition, showing how one flow can be unambiguous yet fail specific or freely given.
Set a consent-design standard for all product surfaces so each of the four conditions is met and provable, instead of fixing flows one at a time.
## The definition The GDPR (Regulation (EU) 2016/679) defines **consent** in `Art. 4(11)` as *any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her*. Every element is a condition. If any one fails, there is no valid consent, and processing that relied on it has no lawful basis. ## The four conditions | Condition | What it requires | Where | |---|---|---| | **Freely given** | A genuine choice: the person can refuse or withdraw without detriment; no clear imbalance of power; not a condition of an unrelated service | `Art. 4(11)`, `Art. 7(4)`, Recitals 42-43 | | **Specific** | Given for one or more specified purposes; separate consent where purposes differ | `Art. 6(1)(a)`, Recitals 32 and 43 | | **Informed** | The person knows at least the controller's identity and the purposes before agreeing, and is told of the right to withdraw | Recital 42, `Art. 7(3)` | | **Unambiguous** | A statement or clear affirmative action that leaves no doubt about the person's wishes | `Art. 4(11)`, Recital 32 | EDPB Guidelines 05/2020 on consent (regulator guidance) set out a minimum for **informed** consent (para. 64): 1. the controller's identity; 2. the purpose of each processing operation for which consent is sought; 3. what (type of) data will be collected and used; 4. the existence of the right to withdraw consent; 5. use of the data for automated decision-making under `Art. 22(2)(c)`, where relevant; 6. the possible risks of transfers without an adequacy decision or `Art. 46` safeguards, where relevant. ## What counts as an affirmative act Recital 32 gives examples of valid acts: a written statement, including by electronic means, an oral statement, **ticking a box** when visiting a website, choosing technical settings for an online service, or other conduct that clearly indicates acceptance in context. It then excludes the opposite: - **silence**; - **pre-ticked boxes**; - **inactivity**. The EDPB adds (paras. 79 and 86) that merely proceeding with a service is not an active indication of choice, and that **scrolling or swiping** through a page will not under any circumstances satisfy the requirement of a clear and affirmative action. ## Why a pre-ticked box fails A pre-ticked box inverts who acts: - **The controller made the choice.** The tick was placed by the page, not by the user. Leaving it there is inactivity. - **Nothing is unambiguous.** A user who never noticed the box and a user who wanted it look the same in the data. - **An opt-out is not an opt-in.** The EDPB says pre-ticked opt-in boxes are invalid (para. 79) and that the GDPR does not allow opt-out constructions that require an intervention to prevent agreement (para. 81). - **The courts agree.** In Planet49 (case C-673/17), the CJEU held that a pre-ticked checkbox which the user had to untick to refuse did not constitute valid consent to storing cookies. The fix is simple: an unticked box, or an equivalent control, that the user must actively select. ## How the conditions interact The conditions are cumulative and they reinforce each other: - A checkbox that is **unticked** but bundles marketing with the terms of service is unambiguous but not **specific** or **freely given**. - A clear "I agree" button beside a vague purpose ("to improve your experience") is unambiguous but not **informed** or **specific**. - A properly worded request that cannot be refused without losing an unrelated service fails **freely given** under `Art. 7(4)`. `Art. 7(1)` then requires the controller to be able to **demonstrate** that the person consented, so each condition must also be provable afterwards. ## Explicit consent is a higher bar Some provisions, such as `Art. 9(2)(a)` for special-category data, require **explicit** consent. That demands an express statement of consent, beyond an affirmative act, and is a stricter standard than the one in `Art. 4(11)`. ## Common mistakes - Treating a pre-ticked box as acceptable if the user "could have unticked it". - Treating continued browsing or scrolling as consent. - Asking for one consent covering several unrelated purposes. - Omitting the right to withdraw from the information given before consent.
- Under the GDPR, can consent be given orally rather than in writing?Yes. Recital 32 lists an oral statement as a valid way to consent. The difficulty is proof: `Art. 7(1)` requires the controller to demonstrate consent, and the EDPB notes that consent can be obtained through a recorded oral statement, with due note of what information the person had beforehand.
- Under EDPB Guidelines 05/2020, is scrolling down a web page a valid way to consent?No. Example 16 (para. 86) says scrolling or swiping through a page will not under any circumstances satisfy the clear affirmative action requirement: it is hard to distinguish from other interaction, so consent cannot be unambiguous, and a withdrawal as easy as giving would be hard to provide.
- Under the GDPR, what is the minimum a person must know for consent to be informed?Recital 42 says at least the controller's identity and the purposes of the processing. EDPB Guidelines 05/2020 (para. 64) add what type of data will be used, the right to withdraw, automated decision-making under `Art. 22(2)(c)` where relevant, and transfer risks without adequacy or `Art. 46` safeguards where relevant.
A pre-ticked box is like a waiter writing down a dessert order for you and asking you to cross it out if you did not want it: whatever arrives, you never actually ordered it.
saying these in an interview costs you the question
- A pre-ticked box is fine because the user could untick it.
- Continuing to browse a site counts as consent under the GDPR.
- Consent is valid once any affirmative click happens, whatever the wording.
- Consent must always be written and signed to be valid.
- Informing people of the right to withdraw is optional.