What Is Valid Consent Under GDPR? Requirements and Latest Updates

Update: October 2026

Consent is one of six lawful bases for processing personal data, and it has the strictest conditions. If consent fails any of these conditions, it is invalid, and any processing that relied on it has no lawful basis.

This guide sets out what makes consent valid under the GDPR, how the ICO and the EDPB apply the rules, what the UK Court of Appeal decided in 2026, and which proposals could change the rules for cookie consent.

Key Takeaways

• Article 4(11) GDPR defines consent as a freely given, specific, informed and unambiguous indication of a person’s wishes, given by a statement or a clear affirmative action. Silence, pre-ticked boxes, and inactivity do not count, and Article 7 requires you to demonstrate consent and let people withdraw it easily at any time.

• In April 2026, the UK Court of Appeal ruled in RTM v Bonne Terre that the consent test is objective. It looks at what the person did and communicated, and the ICO updated its consent guidance in August 2026 in response. The ICO adds that reliance on consent can still fail the fairness requirement when you know, or reasonably ought to know, that the person is in a vulnerable situation.

• Proposed EU reforms to cookie consent are still in negotiation and are not law. Until they change, the current consent rules apply.

Consent Has Four Elements and Two Layers of Conditions

Article 4(11) sets out four elements that must all be present: consent must be freely given, specific, informed, and unambiguous. Article 7 adds conditions on top. You must keep records demonstrating consent, make the request prominent and clear, let the person withdraw consent as easily as they gave it, and consider whether a contract is conditional on unnecessary consent.

The ICO treats the assessment as objective. Valid consent must rest on facts or observable behaviour that can be seen and verified, not on assumptions about what a person felt or meant. If any element is missing, or if you doubt whether someone consented, the consent is not valid. The ICO’s guidance on valid consent sets out each element with examples.

Freely Given Means a Real Choice

If a person has no real choice, consent is not freely given. People must be able to refuse without detriment and to withdraw easily. Article 7(4) says that, when assessing whether consent is freely given, you must consider whether a service is made conditional on consent to processing that is not necessary for it. Recital 43 presumes such consent is not freely given.

The ICO’s example is an online furniture store that requires customers to agree to share their details with other homeware stores before they can complete a purchase. Sharing isn’t necessary for the sale, so consent isn’t freely given. The store could ask for consent to share data with named third parties, with customers able to opt in or out freely.

A clear power imbalance also undermines consent. The ICO notes that consent is harder to obtain when the relationship is unequal, particularly with public authorities and employers. The ICO views offering a benefit for consenting, such as vouchers for joining a loyalty scheme, as not, in itself, a detriment to those who refuse, although the organisation must not unfairly penalise refusal.

Specific and Informed Means Naming Who Gets the Data and Why

A consent request must cover the controller’s identity, the purposes of the processing, the processing activities, and the right to withdraw. The ICO says you need to name any third-party controllers who will rely on the consent. For bought-in data, consent is valid only for your processing if you specifically identified it. Our guide to email lists and GDPR shows how this rule plays out in enforcement.

Recital 43 calls for separate consent for different processing operations wherever appropriate, so granular options are the norm. Vague, sweeping or confusing requests are invalid, and language such as double negatives can invalidate consent. The ICO also says consent can’t evolve. If your purposes change, you need fresh consent or a different lawful basis, even when the new purpose seems compatible.

Unambiguous Means a Clear Opt-In

Recital 32 states that consent requires a clear affirmative act and that silence, pre-ticked boxes or inactivity do not constitute consent. The ICO describes the effect plainly: all consent must be opt-in, and failing to opt out is not consent. Organisations may not rely on default settings, general terms and conditions or inattention.

The Court of Justice reached the same position on cookies in Planet49 (Case C-673/17, 1 October 2019), where it held that a pre-ticked box did not produce valid consent. The Court’s press release summarises the ruling. Commentary on the judgment notes that consent to cookies must also be given specifically, so agreeing to join a promotion does not amount to agreeing to advertising cookies.

Explicit Consent Requires a Statement

Where the law requires explicit consent, for example, to process special category data, the person must confirm it in words, whether written or oral. The ICO explains that consent inferred from actions cannot be explicit consent, however obvious it seems. A statement such as “I consent to you using this information to recommend appropriate beauty products”, with a box to tick, meets the standard in the ICO’s example. The statement should refer to the specific element of the processing that needs explicit consent.

Records, Withdrawal and Duration Complete the Picture

Article 7(1) requires the controller to demonstrate that the person consented. A useful record shows who consented, when, how and what they were told. For oral consent, the ICO says to keep a record of the script.

Article 7(3) gives people the right to withdraw consent at any time, and withdrawal has to be as easy as giving it. When someone withdraws, you must stop processing based on that consent as soon as possible in the circumstances. Earlier processing remains lawful. Offer a simple route, such as an unsubscribe link or a preference page.

The GDPR sets no time limit for consent. The ICO says consent is likely to degrade over time, and how long it lasts depends on context and the person’s expectations, so review and refresh consent at user-friendly intervals.

The 2026 Court of Appeal Ruling Confirms an Objective Test

On 21 April 2026, the Court of Appeal decided RTM v Bonne Terre Ltd (trading as Sky Betting and Gaming) [2026] EWCA Civ 488. According to law-firm summaries of the judgment, the High Court had held that a claimant’s gambling addiction meant his consent to cookies and marketing was ineffective. The Court of Appeal overturned that approach and held that consent is assessed by the person’s actions and communications with the controller, and not by their subjective state of mind. Controllers do not have to investigate vulnerabilities they are unaware of. The High Court remitted the case.

The ICO updated its consent guidance on 4 August 2026 with minor clarifications following the judgment. Its guidance now says that a person’s subjective state of mind or vulnerable situation does not determine whether consent exists; what matters is legal capacity and an objective indication of consent. It also says that where you know, or reasonably ought to know, that someone is in a vulnerable situation, relying on their consent is unlikely to meet the fairness requirement. The ICO notes that it is reviewing its consent guidance under the Data (Use and Access) Act, so check it for further changes.

The ruling concerns UK law. The EDPB’s Guidelines 05/2020 on consent remain the main EU reference.

EU Cookie Consent Reform Is Still a Proposal

The Commission’s Digital Omnibus proposal would move rules on consent for terminal equipment, which today sit in the ePrivacy Directive, into the GDPR. Reports on the Council’s negotiations differ on which provisions have survived, including a proposal for browser signals that was reported removed in June 2026. The measure still needs agreement from the Parliament and the Council. Treat it as a proposal and check official texts for the current position.

A Consent Audit Starts With Your Forms and Records

Check each consent request against the ICO’s list of reasons consent fails: doubts over whether someone consented, a person who did not realise they had consented, missing records, no genuine free choice, penalties for refusal, bundled terms, vague requests, pre-ticked boxes, your organisation not being named, no information on withdrawal, withdrawal that is hard to do, and purposes that have moved beyond the original consent.

Where consent does not fit, another lawful basis may. For children’s services, Article 8 sets additional rules on parental consent, covered in our guide to children’s data under GDPR. GDPRLocal helps organisations review consent flows, records and lawful basis choices. See our GDPR consultant services.

Conclusion

Valid consent requires free choice, a specific and informed request, a clear opt-in, a record, and the ability to withdraw at any time. Missing any one of these makes the consent an unreliable lawful basis.

The most recent development is the Court of Appeal’s confirmation that the test is objective, along with the ICO’s guidance that fairness still matters where vulnerability is known. In the EU, the proposed cookie reforms are still moving, and the current rules apply until they change. Reviewing forms, records and withdrawal routes now will cover both.

Frequently Asked Questions

What Makes Consent Valid Under the GDPR?

Consent is valid when it is freely given, specific, informed, and unambiguous; expressed by a statement or clear affirmative action; and the controller can demonstrate it. People must be able to withdraw it as easily as they gave it.

Are Pre-Ticked Boxes Valid Consent?

No. Recital 32 says pre-ticked boxes and inactivity do not constitute consent, and the Court of Justice confirmed in Planet49 that a pre-ticked box does not produce valid consent for cookies.

How Long Does Consent Last?

The GDPR sets no fixed period. The ICO says consent duration depends on the context, the scope of the original consent, and the person’s expectations. Review consents regularly and refresh them when your purposes change.

Disclaimer: This blog post is intended solely for informational purposes. It does not offer legal advice or opinions. This article is not a guide for resolving legal issues or managing litigation on your own. It should not be considered a replacement for professional legal counsel and does not provide legal advice for any specific situation or employer.