May we include consent in our general terms and conditions?

Paragraph 2 allows consent to be part of a written declaration that also concerns other matters, but then the request must be clearly distinguishable, intelligible and in plain language. Any part of that declaration that infringes the Regulation is not binding on the data subject. Recital 42 adds that the data subject must be aware that they are giving consent and how far it extends.

A customer withdraws consent. Was everything we did before that unlawful?

No. Paragraph 3 states explicitly that withdrawal does not affect the lawfulness of processing before the withdrawal. From the moment of withdrawal, you can no longer use the consent as a legal basis. Withdrawal must also be as easy as giving consent.

May we offer our free app only to users who consent to marketing?

Paragraph 4 says that, in assessing whether consent is freely given, utmost account is taken of whether a service is made conditional on consent that is not necessary for that service. Recital 43 states that consent is then presumed not to be freely given. If the marketing processing is not needed to deliver the app, such tied consent does not, on the text of paragraph 4 and recital 43, meet the requirement of being freely given.

Article 7: Conditions for consent

Praxikon tracks Article 7 (Conditions for consent) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIn force since 25-05-2018

Article 7 sets the conditions consent must meet when you use it as a legal basis. Paragraph 1 places the burden of proof on the controller: it must be able to demonstrate that the data subject has consented. Paragraph 2 requires that a request for consent in a document that also covers other matters is clearly distinguishable, intelligible and in plain language. Paragraph 3 gives the data subject the right to withdraw consent at any time, as easily as it was given, and paragraph 4 provides that, in assessing whether consent is freely given, utmost account is taken of whether a service is made conditional on consent that is not necessary for that service; recital 43 then presumes that consent is not freely given. The article exists because consent only offers real protection if it is free, informed and revocable.

Key term: Freely given consent: a choice the data subject can genuinely refuse or withdraw without detriment, and that is not tied to a service as a condition (paragraph 4)

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Keep evidence of every consent: who, when, for what and how (paragraph 1). Ask for consent separately and in plain language, not hidden in general terms and conditions (paragraph 2), and, as recital 32 requires, through a clear affirmative action: no pre-ticked boxes and no silence. Make withdrawing as simple as giving and tell the data subject beforehand that withdrawal is possible (paragraph 3); do not tie a service to consent that is not necessary for that service (paragraph 4).

Data Protection Officer

For each consent flow, check that the organisation can demonstrate the consent (paragraph 1), that the request stands apart from other matters (paragraph 2) and that withdrawal is as easy as giving (paragraph 3). Following recital 43, watch for situations with a clear imbalance between the data subject and the controller, in particular where the controller is a public authority.

Data Subject

You do not have to prove anything: the organisation must demonstrate that you consented (paragraph 1). You may withdraw your consent at any time, as easily as you gave it, without the earlier processing becoming unlawful (paragraph 3). If a service is refused because you do not consent to something that is not necessary for that service, paragraph 4 requires that to weigh very heavily, and recital 43 presumes that your consent was not freely given.

Compliance checklist

For every consent it is recorded who gave it, when, for what and in what way (Article 7(1)).The request for consent is clearly separated from other matters and written in intelligible, plain language (Article 7(2)).Separate consent is requested for different processing operations where that is appropriate (recitals 32 and 43 to Article 7).Data subjects are informed before giving consent that they can withdraw it (Article 7(3)).Withdrawing consent is as easy as giving it, for example through the same channel (Article 7(3)).After withdrawal, processing based on that consent stops (Article 7(3)).No service is made conditional on consent to processing that is not necessary for that service (Article 7(4)).

Related recitals

(32)

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relatin...

(33)

It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give t...

(42)

Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context ...

(43)

In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the dat...

Frequently asked questions

← Art. 6: Lawfulness of processing Art. 8: Conditions applicable to child's consent in relation to information society services →

Connections

Case law

Meta v Bundeskartellamt: competition authority may find a GDPR breach, strict conditions for legal bases behind personalised advertising
2023-07-04 · final, Hof van Justitie van de EU (Grote kamer), Meta Platforms Inc., Meta Platforms Ireland Ltd en Facebook Deutschland GmbH tegen Bundeskartellamt

Guidelines

Guidelines 05/2020 on consent under Regulation 2016/679
2020-05-04 · final, European Data Protection Board (EDPB)

Legislation in motion

Proposal: consent and objection via machine-readable browser signals (new Article 88b GDPR)
2025-11-19 · under negotiation, Europese Commissie
Proposal: cookie rules move from ePrivacy to the GDPR, with new exceptions and a six-month rule (new Article 88a GDPR and Article 5(3) ePrivacy)
2025-11-19 · under negotiation, Europese Commissie