Consent is one of the legal bases for processing personal data under the GDPR. For cookies, consent is the most common legal basis for analytical and marketing cookies.
Requirements for valid consent
Under the GDPR, consent must be:
- Freely given – The user must not be forced to give consent
- Specific – Separate consent for each processing purpose
- Informed – The user must know what they are consenting to
- Unambiguous – An active action by the user (clicking a button)
What is not valid consent
- Pre-ticked checkboxes
- "By continuing to use the website you agree..."
- Consent coerced by making access to content conditional
- Unclear or overly complex wording
Withdrawal of consent
The user has the right to withdraw consent at any time. Withdrawal must be as easy as giving consent. Therefore, the cookie banner should include the option to change preferences.
Demonstrating consent
The data controller must be able to demonstrate that consent was given. It is therefore important to keep records of consents granted (timestamp, IP address, version of the consent text).