What does GDPR Article 7 require for valid consent?

Consent is the lawful basis people reach for first and get wrong most often. Choosing consent under Article 6 is only the start; Article 7 sets the conditions that decide whether that consent actually counts. Miss them and the processing has no valid basis at all, which is one of the more serious failures under the regulation.

What are the conditions in Article 7?

There are four, and they are practical rather than abstract. First, under Article 7(1) you must be able to demonstrate that the person consented, so consent has to be logged, not assumed. Second, under Article 7(2), where consent sits inside a wider written document the request must be clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Third, under Article 7(3) the person can withdraw consent at any time, and withdrawing must be as easy as giving it. Fourth, under Article 7(4), if you make a service conditional on consent to processing the service does not need, that weighs heavily against the consent being freely given.

What does "freely given" actually mean?

Recital 32 describes valid consent as a clear affirmative act that is freely given, specific, informed, and unambiguous. Recital 42 adds that consent is not freely given if the person cannot refuse or withdraw without detriment, and Recital 43 flags a clear imbalance of power, such as consent demanded by a public authority. The practical test is whether the person had a real choice. Pre-ticked boxes, silence, and inactivity do not qualify, and neither does an all-or-nothing wall that forces agreement to unrelated processing.

Withdrawal has to be genuinely easy

The symmetry rule in Article 7(3) trips up a lot of designs. If a person opted in with one click, you cannot make them phone a support line or write a letter to opt out. Withdrawal does not retroactively make past processing unlawful, but from the moment consent is withdrawn you have to stop the processing that relied on it. Build the off switch at the same time you build the on switch, and treat withdrawal requests as promptly as you treat sign-ups.

Where consent fits with your other duties

Consent is one of six bases, not the default. For much of what a business does, contract or legitimate interests is the better fit, and consent is reserved for things like marketing and non-essential cookies. Getting the basis wrong, or relying on consent that cannot meet Article 7, is exactly the kind of failure that sits in the upper tier of GDPR fines. Record which basis covers each activity and keep the evidence.

Next step

If any of your processing runs on consent, Article 7 is where that consent is won or lost. The free 2-minute Obligation Scan flags where you are relying on consent, whether the opt-in and withdrawal meet the Article 7 conditions, and where a different lawful basis would be sounder. The GDPR compliance hub sets out the duties that surround it.