What Is Valid Consent? (ICO)
The UK Information Commissioner’s Office’s guidance on what makes consent valid under the UK GDPR. The UK GDPR keeps the EU GDPR’s definition of consent and its Article 7 conditions, so the guidance works through the same “freely given, specific, informed and unambiguous” test, with worked examples of each. At the time of capture the page carried a notice that it was under review following the Data (Use and Access) Act.
License: Open Government Licence v3.0 — https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/ (stated in the page’s own footer).
Key points
- Validity is an objective test: a consent request is judged by what the person observably did, not by assumptions about what they meant.
- Making consent a condition of a service is presumed invalid when the processing isn’t needed for that service. In the ICO’s example, an online furniture store’s checkout requiring consent to share customer details with other homeware stores isn’t valid, while sharing details with the delivery courier is needed to fulfill the order (and is better grounded in contract than in consent).
- Offering an incentive for consenting (e.g. loyalty-scheme vouchers) can be acceptable, but refusing must not leave someone unfairly penalized.
- A consent request has to name the organization and any third-party controllers relying on it, give separate options for separate purposes and processing activities wherever possible, and tell people they can withdraw consent (and, as the ICO advises, how).
- The request should be prominent, concise, separate from other terms and conditions, and in plain language. Vague or sweeping wording invalidates consent, and so does confusing language such as double negatives or inconsistent terms.
- To avoid disrupting the user experience, the ICO suggests layered information and just-in-time consent requests. But avoiding disruption doesn’t excuse an unclear request, and some disruption may be necessary to get valid consent.
- There is no “opt-out consent”: silence, inactivity, default settings, and pre-ticked boxes don’t count. Affirmative methods include ticking a box, a binary choice presented with equal prominence, and switching a setting away from its default.
- Explicit consent, needed for some processing such as special-category data, has to be confirmed in an express statement. The ICO contrasts a beauty spa form’s optional “skin conditions” field (likely implied consent) with the same field plus “I consent to you using this information to recommend appropriate beauty products ☐” (explicit consent).
- Consent has no fixed expiry, but it degrades over time and doesn’t stretch to cover new purposes (“there is no such thing as ‘evolving’ consent”). Organizations should refresh it when purposes change and at user-friendly intervals.
- Withdrawing consent must be possible at any time. If an organization couldn’t actually act on a withdrawal (e.g. deleting research data would undermine the study), consent is the wrong lawful basis.