GDPR consent rules for product teams: what counts as valid

Valid GDPR consent is a freely given, specific, informed and unambiguous indication of the person's wishes, shown by a statement or clear action. You must be able to prove it, it must be as easy to withdraw as to give, and it cannot be bundled with unrelated terms.

The definition

Article 4(11) defines consent as any freely given, specific, informed and unambiguous indication of the person's wishes by a statement or a clear affirmative action. Article 7 adds the conditions.

Article 7 in practice

• Demonstrable. You must be able to show that the person consented. Store who, when, which version of the text and which purposes.
• Distinguishable. If consent sits inside a written declaration that covers other matters, the request must be clearly distinguishable from them, in clear and plain language.
• Withdrawable. People can withdraw at any time, you must tell them before they consent, and withdrawing must be as easy as giving consent. Earlier processing stays lawful.
• Not tied to the service. In judging whether consent is freely given, consider whether performance of a contract is made conditional on consent to processing that the contract does not need.

A checklist for your flow

1. One purpose per checkbox. Do not combine marketing, analytics and sharing.
2. No pre ticked boxes. A clear affirmative action means the person does something.
3. Plain labels that say what will happen and who will do it.
4. A link to the privacy notice at the point of choice.
5. A settings page to withdraw, reachable in as few clicks as the sign up took.
6. Withdrawal propagates to every system and processor, and you can show it did.
7. A consent log with timestamp, text version and purpose.

When not to ask for consent

If you rely on a different basis, do not also ask for consent as a decoration. It confuses people and can imply they have a choice you cannot honour. Choose the basis first, see the lawful basis decision guide.

Gating the service

Refusing to provide a service unless someone agrees to unrelated processing is a warning sign under Article 7(4). A fitness app that requires consent to advertising profiles in order to log a run is an example of the pattern to avoid.

What this post does not cover

Rules for cookies and similar technologies come from separate ePrivacy law, and children's consent has its own age rule in Article 8. Check both if they apply.

Quick check

Sources

• GDPR Article 7, conditions for consent
• GDPR Article 4, definitions
• GDPR Article 6, lawfulness of processing

Last reviewed: 19 October 2026.