EDPB Guidelines 05/2020: Criteria for Valid Consent under the GDPR

The 4 Cumulative Criteria for Valid Consent (Art. 4.11 & 7)

Under EDPB Guidelines 05/2020, consent is legally valid only if it cumulatively fulfills the four requirements set out in Article 4(11) and Article 7 GDPR, as interpreted by the CJEU in Planet49 (C-673/17):

• Freely given: Absence of manifest imbalance of power, coercion, or negative consequences in the event of refusal. 'Cookie walls' that condition access to a service on consent without offering a genuine equivalent alternative preclude freely given consent;
• Specific: Given distinctly for each specified purpose. Bundling multiple processing purposes within an all-or-nothing consent option invalidates consent;
• Informed: Clear prior notice disclosing the controller's identity, the specific processing purposes, categories of data collected, the right to withdraw consent, and any automated decision-making;
• Unambiguous: A clear affirmative action (pre-ticked boxes, silence, inactivity, or passive scrolling do not constitute a valid manifestation of the data subject's wishes).

The data subject must be able to withdraw consent at any time as easily as it was given (Art. 7.3 GDPR).

Verified Official Sources

Associated Operational Micro-Tools

See Also in the Legal Framework