Regulation (EU) 2016/679 — General Data Protection Regulation (EUR-Lex official text)

The official EUR-Lex text of the GDPR itself — the primary legal source behind the consent and transparency requirements General Data Protection Regulation (Wikipedia) summarizes.

License: Official EU legislative text, freely reusable per Commission Decision 2011/833/EU — the same basis already used for EU AI Act — Article 50 (Transparency Obligations).

Key points

Recital 32 states the exact consent-design standard in the regulation’s own words: consent must be given “by a clear affirmative act” — a written statement, an oral statement, or “ticking a box when visiting an internet website” — and explicitly rules out silence, pre-ticked boxes, or inactivity as valid consent.
Recital 32 also sets a UX-facing bar for a consent request specifically: when consent is requested by electronic means, “the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.”
Recital 39 grounds the transparency principle in plain-language terms: information given to a data subject about how their data is processed must be “easily accessible and easy to understand,” using “clear and plain language.”