What Is Consent Under GDPR?

Each of the four words rules something out. Freely given rules out consent extracted by conditioning a service on processing that is not needed to deliver it, which Article 7(4) requires to be taken into account. Specific rules out one checkbox covering several unrelated purposes. Informed rules out consent given without knowing who is processing, for what, and that it can be withdrawn. Unambiguous rules out anything the person did not actively do.

Article 7(1) adds the requirement that makes the rest enforceable: the controller has to be able to demonstrate that consent was given. That turns the record into part of the obligation, so what was agreed, when, and against which wording all have to be retrievable later.

Article 7(3) gives the right to withdraw at any time and requires withdrawal to be as easy as giving consent was. Processing that happened before withdrawal does not become unlawful, but processing after it does, so the mechanism has to take effect rather than simply exist.

This is the legal reason a one-click unsubscribe and a working preference page are mechanical requirements rather than courtesies. A signup that took one click and an opt-out that requires an email to support does not meet the standard, whatever the privacy notice says.

When you would continue processing after a refusal. If the answer no does not stop the activity, consent was never the honest description of what was happening, and a different Article 6 basis should be identified and disclosed instead. Regulators treat consent used as a formality as no consent at all.

Cold outreach is the clearest case. Consent by definition does not exist at first contact, which is why B2B programmes in the EU and UK lean on legitimate interest for the data and on the PECR corporate subscriber position for the channel. Which of those actually covers a given list is a legal assessment, not a setting in a tool.