Fiche 23/54 Part 3 — Lawfulness & Key Actors Intermediate Reviewed 2026-08-23

Consent Regime & Validity Standards (Art. 4.11 & 7)

To be legally valid, consent must meet four cumulative criteria under Article 4(11): freely given, specific, informed, and unambiguous. It must be as simple to withdraw consent at any time as it was t

Open in interactive reader

⚖️ Cumulative Validity Standards 📋 EDPB Guidelines 05/2020 on Consent

Consent Regime & Validity Standards (Art. 4.11 & 7)

⚡ In 30 seconds

Under Article 4(11), consent is any freely given, specific, informed and unambiguous indication of the data subject's wishes by which they signify agreement by a clear affirmative action. Article 7 imposes the burden of proof on the controller and guarantees the individual's right to withdraw consent at any time without detriment.

Validity Criterion	Legal Requirement	Invalid Practice (Non-Compliant)
Freely Given	Genuine freedom of choice; no power imbalance or forced bundling (Art. 7.4).	Requiring marketing consent as a condition of accessing software.
Specific	Granular consent separated by discrete purpose.	A single checkbox accepting both Terms of Service and data monetization.
Informed	Identity of controller, purposes, data types, and right to withdraw stated clearly.	Vague references hidden deep within a 40-page legal disclaimer.
Unambiguous	Clear affirmative action (explicit opt-in, toggle activation).	Pre-ticked checkboxes; continued browsing construed as consent.

⚡ Key Takeaways

Consent in employment relationships is generally presumed invalid due to the power imbalance.
Children's digital consent threshold is 16 years, lowered to 13–15 in some Member States (13 in Belgium).
Controllers must record timestamped proof of the affirmative opt-in under accountability.

⚠️ Common Pitfall

Making withdrawal convoluted (e.g. requiring a registered postal letter) when consent was obtained via a single web click.

🛠️ In Practice

Implement one-click consent management widgets that log versioned consent timestamps in auditable databases.

⚖️ Official Sources: Art. 4(11), 7, 8 GDPR · Recitals 32, 42, 43 · EDPB Guidelines 05/2020 · CJEU C-673/17 Planet49 ✓ Legal review: 23 August 2026