May we include consent in our general terms and conditions?

Paragraph 2 allows consent to be part of a written declaration that also concerns other matters, but then the request must be clearly distinguishable, intelligible and in plain language. Any part of that declaration that infringes the Regulation is not binding on the data subject. Recital 42 adds that the data subject must be aware that they are giving consent and how far it extends.

A customer withdraws consent. Was everything we did before that unlawful?

No. Paragraph 3 states explicitly that withdrawal does not affect the lawfulness of processing before the withdrawal. From the moment of withdrawal, you can no longer use the consent as a legal basis. Withdrawal must also be as easy as giving consent.

May we offer our free app only to users who consent to marketing?

Paragraph 4 says that, in assessing whether consent is freely given, utmost account is taken of whether a service is made conditional on consent that is not necessary for that service. Recital 43 states that consent is then presumed not to be freely given. If the marketing processing is not needed to deliver the app, such tied consent does not, on the text of paragraph 4 and recital 43, meet the requirement of being freely given.

Article 7: Conditions for consent

Praxikon tracks Article 7 (Conditions for consent) under the GDPR, alongside the EU AI Act, citing the source for every statement.

Chapter IIIn force since 25-05-2018

Article 7 sets the conditions consent must meet when you use it as a legal basis. Paragraph 1 places the burden of proof on the controller: it must be able to demonstrate that the data subject has consented. Paragraph 2 requires that a request for consent in a document that also covers other matters is clearly distinguishable, intelligible and in plain language. Paragraph 3 gives the data subject the right to withdraw consent at any time, as easily as it was given, and paragraph 4 provides that, in assessing whether consent is freely given, utmost account is taken of whether a service is made conditional on consent that is not necessary for that service; recital 43 then presumes that consent is not freely given. The article exists because consent only offers real protection if it is free, informed and revocable.

Key term: Freely given consent: a choice the data subject can genuinely refuse or withdraw without detriment, and that is not tied to a service as a condition (paragraph 4)

Directly affects:controllerdata subject

Praxikon’s reading of the text and the recitals; the official text below prevails.

Official text

Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.

If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.

The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.

When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.

Source: EUR-Lex, Regulation (EU) 2016/679. Official text, reproduced without modification.

What does this mean for you?

Controller

Keep evidence of every consent: who, when, for what and how (paragraph 1). Ask for consent separately and in plain language, not hidden in general terms and conditions (paragraph 2), and, as recital 32 requires, through a clear affirmative action: no pre-ticked boxes and no silence. Make withdrawing as simple as giving and tell the data subject beforehand that withdrawal is possible (paragraph 3); do not tie a service to consent that is not necessary for that service (paragraph 4).

Data Protection Officer

For each consent flow, check that the organisation can demonstrate the consent (paragraph 1), that the request stands apart from other matters (paragraph 2) and that withdrawal is as easy as giving (paragraph 3). Following recital 43, watch for situations with a clear imbalance between the data subject and the controller, in particular where the controller is a public authority.

Data Subject

You do not have to prove anything: the organisation must demonstrate that you consented (paragraph 1). You may withdraw your consent at any time, as easily as you gave it, without the earlier processing becoming unlawful (paragraph 3). If a service is refused because you do not consent to something that is not necessary for that service, paragraph 4 requires that to weigh very heavily, and recital 43 presumes that your consent was not freely given.

Compliance checklist

For every consent it is recorded who gave it, when, for what and in what way (Article 7(1)).The request for consent is clearly separated from other matters and written in intelligible, plain language (Article 7(2)).Separate consent is requested for different processing operations where that is appropriate (recitals 32 and 43 to Article 7).Data subjects are informed before giving consent that they can withdraw it (Article 7(3)).Withdrawing consent is as easy as giving it, for example through the same channel (Article 7(3)).After withdrawal, processing based on that consent stops (Article 7(3)).No service is made conditional on consent to processing that is not necessary for that service (Article 7(4)).

Related recitals

(32)

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of personal data relatin...

(33)

It is often not possible to fully identify the purpose of personal data processing for scientific research purposes at the time of data collection. Therefore, data subjects should be allowed to give t...

(42)

Where processing is based on the data subject's consent, the controller should be able to demonstrate that the data subject has given consent to the processing operation. In particular in the context ...

(43)

In order to ensure that consent is freely given, consent should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the dat...

In addition to the overview at the bottom of this page: rulings, guidelines and fines that interpret or apply this article, newest first. Each item was checked against the official source.

Case law (4)

27 October 2022 · C-129/21 · CJEU
Proximus
Inclusion in public telephone directories requires consent within the meaning of the GDPR. A request to be removed from directories is an exercise of the right to erasure, and the directory provider must take reasonable steps to inform other providers and search engines.
11 November 2020 · C-61/19 · CJEU
Orange Romania
The controller must show that the data subject gave active and informed consent. A box ticked by the seller in a contract does not prove that.
1 October 2019 · C-673/17 · CJEU
Planet49
A pre-ticked checkbox does not give valid consent for cookies. Users must also be told how long cookies operate and whether third parties can access them.
29 July 2019 · C-40/17 · CJEUDirective 95/46
Fashion ID
A website embedding a Facebook button is a joint controller, but only for collecting and transmitting visitor data. Consumer associations may bring proceedings on behalf of data subjects.

Guidelines (3)

9 October 2025 · EDPB and European CommissionConsultation version
Joint Guidelines on the Interplay between the Digital Markets Act and the General Data Protection Regulation
Draft by the EDPB and the European Commission explaining how gatekeepers comply coherently with the DMA and the GDPR, including on consent and data portability.
17 April 2024 · EDPB
Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms
Assesses when large online platforms that let users choose between consenting to behavioural advertising and paying obtain valid, freely given consent.
14 February 2023 · v2.0 · EDPB
Guidelines 03/2022 on deceptive design patterns in social media platform interfaces: how to recognise and avoid them
Describes types of deceptive design patterns in social media interfaces and how they conflict with the GDPR, with practical recommendations for designers.

Line of case lawConsent and cookies

When is consent valid?

Planet49 (2019)A pre-ticked box is not consent.
Guidelines 05/2020 on consent under Regulation 2016/679 (2020)The EDPB: cookie walls and scrolling do not give valid consent.
Orange Romania (2020)The controller must prove consent.
Meta Platforms v Bundeskartellamt (2023)A dominant position does not rule out consent but weighs heavily.
Opinion 08/2024 on Valid Consent in the Context of Consent or Pay Models Implemented by Large Online Platforms (2024)Pay or consent on large platforms is usually not a free choice.
Inteligo Media (2025)Within the ePrivacy soft opt-in no separate GDPR basis is needed.
Digital Omnibus: proposal amending the GDPR (2025)Proposal to move cookie rules into the GDPR.

Checked on 5 November 2026

Frequently asked questions

← Art. 6: Lawfulness of processing Art. 8: Conditions applicable to child's consent in relation to information society services →

Connections

Case law

Meta v Bundeskartellamt: competition authority may find a GDPR breach, strict conditions for legal bases behind personalised advertising
2023-07-04 · final, Hof van Justitie van de EU (Grote kamer), Meta Platforms Inc., Meta Platforms Ireland Ltd en Facebook Deutschland GmbH tegen Bundeskartellamt

Guidelines

Guidelines 05/2020 on consent under Regulation 2016/679
2020-05-04 · final, European Data Protection Board (EDPB)

Legislation in motion

Proposal: consent and objection via machine-readable browser signals (new Article 88b GDPR)
2025-11-19 · under negotiation, Europese Commissie
Proposal: cookie rules move from ePrivacy to the GDPR, with new exceptions and a six-month rule (new Article 88a GDPR and Article 5(3) ePrivacy)
2025-11-19 · under negotiation, Europese Commissie