Make your website GDPR compliant today — Cookiebot automates cookie consent, scanning, and compliance so you don't have to.
Try Cookiebot Free
Article 7
Conditions for consent
Chapter 2|Principles|📖 7 min read
1. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
2. If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
3. The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
Understanding This Article
Article 7 establishes the specific conditions that must be met for consent to be valid under GDPR. While Article 4(11) defines what consent is (freely given, specific, informed, and unambiguous indication of wishes), and Article 6(1)(a) establishes consent as one legal basis for processing, Article 7 sets out the practical requirements for obtaining and managing consent.
Demonstrable Consent (Paragraph 1):
This paragraph implements the accountability principle specifically for consent. Controllers must not only obtain consent but be able to prove they obtained it properly. This means maintaining records showing: who consented, when they consented, what information was provided, what they consented to, and how consent was obtained. You cannot simply assume consent or rely on vague evidence. If a supervisory authority or data subject questions whether valid consent exists, the controller must produce clear evidence. This shifts the burden of proof to the controller.
Clear and Distinguishable Consent Requests (Paragraph 2):
This addresses the common practice of bundling consent requests within lengthy terms and conditions. Consent requests must be clearly separated from other legal text, presented in plain language that average people can understand, and easily accessible (not buried in small print or requiring extensive scrolling). The regulation specifically states that if the consent request violates GDPR, it is not binding - you cannot enforce invalid consent. Practically, this means: use clear headings, separate consent from other contractual terms, avoid legal jargon, use simple sentence structures, and make consent requests visually distinct (separate boxes, different formatting, etc.). Importantly, each purpose should have a separate consent mechanism - bundled or granular consent for distinct purposes.
Right to Withdraw (Paragraph 3):
This is a fundamental protection ensuring consent remains voluntary throughout processing, not just at the initial collection point. Data subjects can withdraw consent anytime without needing to provide reasons. Withdrawal doesn't retroactively invalidate past processing that occurred when valid consent existed, but it must stop future processing based on that consent. Controllers must inform people about their withdrawal rights before obtaining consent - this information requirement ensures informed decision-making. Critically, withdrawing consent must be 'as easy as giving it.' If consent was obtained via a single click, withdrawal should also be a single click, not a multi-step process requiring emails to customer service or navigating through complex account settings. Many enforcement actions have targeted organizations making withdrawal deliberately difficult.
Freely Given Consent (Paragraph 4):
This paragraph addresses a key requirement from the consent definition: consent must be 'freely given,' meaning a genuine choice. Consent is not free if there are negative consequences for refusing. The article specifically highlights 'consent or service' conditioning: if you make contract performance or service provision dependent on consenting to data processing that isn't actually necessary for that service, the consent is not freely given. For example, a flashlight app cannot make its basic functionality conditional on consenting to location tracking, because location data isn't necessary for a flashlight. This prevents 'take it or leave it' scenarios where individuals have no real choice. Assessment factors include: power imbalance (employer-employee, public authority-citizen), bundling (all-or-nothing consent for multiple purposes), detriment for refusal, and whether the service can function without the data.
Relationship to Other Articles:
Article 7 works alongside Article 4(11)'s consent definition, Article 6(1)(a)'s consent as legal basis, Article 8's special rules for children's consent, Article 13/14's transparency requirements to inform about consent and withdrawal, and Article 17's right to erasure when consent is withdrawn. Together, these create comprehensive consent requirements far stricter than pre-GDPR standards.
Key Points
Controllers must be able to demonstrate that valid consent was obtained - burden of proof lies with the controller
Consent requests must be clearly distinguishable, in plain language, and separate from other terms and conditions
Data subjects have the right to withdraw consent at any time, and withdrawal must be as easy as giving consent
Consent is not freely given if contract performance is conditional on consenting to unnecessary data processing
Pre-ticked boxes, silence, or inactivity do not constitute valid consent under GDPR
Practical Application
Demonstrable Consent Example: A website implementing a cookie consent banner maintains records showing: timestamp of consent, IP address, which cookie categories were accepted, what information was displayed in the consent notice, and the version of the privacy policy. When a user questions their consent six months later, the company can produce exact records showing what the user agreed to and when. Conversely, a company claiming 'we assume users consent by using our website' fails this requirement entirely.
Clear Presentation Example (Good): An app registration form states in a separate, clearly labeled section: 'Marketing Communications - We'd like to send you emails about our new products and special offers. You can unsubscribe anytime.' Below this explanation is an unchecked box saying 'Yes, I'd like to receive marketing emails.' This is distinguishable, intelligible, and uses plain language. Bad Example: Buried in paragraph 47 of 50-page terms and conditions: 'You agree that Company may process your personal data for marketing, analytics, and other purposes as determined by Company.' This fails the clear and distinguishable requirement.
Withdrawal Example (Good): A marketing email includes an 'Unsubscribe' link at the top that, when clicked, immediately removes the user from the mailing list with a confirmation message. The original signup was a single click, and unsubscribing is equally simple. Bad Example: To withdraw consent, users must send an email to a generic customer service address, provide their account number, specify exactly which processing they're withdrawing consent for, and wait 30 days for processing. This makes withdrawal much harder than giving consent and violates Article 7(3).
Freely Given Consent Example (Good): A fitness app asks separately: 'Can we process your workout data to provide training recommendations? [Yes/No]' and 'Can we send you marketing emails? [Yes/No]' Users can refuse marketing while still using the app's core functionality. Bad Example: The same fitness app states: 'By creating an account, you consent to our processing of your data for app functionality, analytics, advertising, and marketing purposes. You must accept all these purposes to use our service.' This bundled, all-or-nothing approach means consent is not freely given, especially for purposes unnecessary for the service.
Conditional Service Example (Violation): A news website requires users to consent to behavioral advertising tracking to read articles. Since displaying articles doesn't require behavioral advertising data, conditioning access on this consent violates Article 7(4). The website could offer a paid ad-free version or use contextual (non-tracking) advertising instead. Compliant Alternative: The website offers a choice: 'Read with personalized ads (requires consent to tracking)' or 'Read with standard ads (no tracking)' or 'Subscribe for ad-free access.' This gives users genuine choices.
Pre-Ticked Boxes (Violation): An e-commerce checkout includes a pre-checked box stating 'I agree to receive partner marketing emails.' Users who don't notice can uncheck this are deemed to have consented. This violates both the 'unambiguous indication' requirement (Article 4(11)) and clear presentation requirements (Article 7(2)). Consent requires a clear affirmative action, not opting out of a default. Compliant Version: The same box appears unchecked, requiring users to actively tick it to consent.
Employment Context: An employer asks employees to consent to processing their personal data for payroll purposes. Given the power imbalance and that payroll processing is a legal obligation and contract necessity, consent is not an appropriate legal basis here - it cannot be freely given in such contexts. The employer should rely on legal obligation (Article 6(1)(c)) or contract (Article 6(1)(b)) instead. However, if the employer asks for consent to publish employee photos on their website, and makes clear this is optional with no employment consequences for refusal, consent can be valid.
Children's Consent: A social media platform targeting teenagers must not only meet Article 7 requirements but also Article 8's special conditions for children's consent, including age verification and parental consent mechanisms for users under 16 (or the lower age set by member states, minimum 13). The platform cannot claim valid consent from a 14-year-old without parental authorization.
Record-Keeping Best Practice: Implement a consent management system that logs: user identifier, timestamp (including timezone), consent version number, what information was presented (save the exact privacy notice version), which purposes were consented to, method of consent (web form, email, verbal with confirmation), IP address or device identifier, and withdrawal timestamps if applicable. Retain these records as long as you process the data plus a reasonable period to defend against potential claims.