# Regulatory Standards — Implementing GDPR-Valid Consent

## Primary Regulations

### GDPR — Regulation (EU) 2016/679

- **Article 4(11)**: Defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."
- **Article 6(1)(a)**: Establishes consent as one of six lawful bases for processing personal data.
- **Article 7(1)**: Requires the controller to be able to demonstrate that the data subject has consented.
- **Article 7(2)**: Requires that consent requests be presented in a manner clearly distinguishable from other matters, in an intelligible and easily accessible form, using clear and plain language.
- **Article 7(3)**: Grants the right to withdraw consent at any time. Withdrawal must be as easy as giving consent.
- **Article 7(4)**: Prohibits making consent a precondition for performance of a contract when processing is not necessary for that contract (the "conditionality test").
- **Article 8**: Sets conditions for children's consent in relation to information society services.
- **Recital 32**: Clarifies that consent should be given by a clear affirmative act. Silence, pre-ticked boxes, or inactivity do not constitute consent. Where processing has multiple purposes, consent should be given for all of them.
- **Recital 42**: States that consent is not freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.
- **Recital 43**: Clarifies that consent is presumed not to be freely given where there is a clear imbalance between the data subject and the controller, including where the controller is a public authority.

### ePrivacy Directive 2002/58/EC (as amended by 2009/136/EC)

- **Article 5(3)**: Requires consent for storing or accessing information on a user's terminal equipment (cookies and similar technologies). Exemptions apply only for technically necessary storage.

## Case Law

### CJEU Case C-673/17 — Planet49 GmbH (October 1, 2019)

The Court ruled that:
1. A pre-ticked checkbox does not constitute valid consent for the placement of cookies under Article 5(3) of the ePrivacy Directive read in conjunction with the GDPR.
2. Consent must be specific — separate consent is required for each distinct purpose.
3. The information provided to the user must include the duration of cookie operation and whether third parties will have access to the cookies.

### CJEU Case C-61/19 — Orange Romania (November 11, 2020)

The Court confirmed that consent requires active behavior. A contract pre-filled with a consent checkbox (even if the customer could request its removal) does not constitute valid consent under Article 4(11) GDPR.

## Supervisory Authority Guidance

### EDPB Guidelines 05/2020 on Consent under Regulation 2016/679 (Version 1.1, adopted May 4, 2020)

- Paragraph 13-25: Freely given — conditionality, granularity, detriment, power imbalance
- Paragraph 26-36: Specific — purpose limitation, granularity, separation of information
- Paragraph 37-50: Informed — minimum content requirements, layered notices
- Paragraph 51-63: Unambiguous indication — active behavior requirement
- Paragraph 64-75: Clear affirmative action — acceptable and unacceptable mechanisms
- Paragraph 76-88: Additional conditions — scrolling, cookie walls, consent fatigue
- Paragraph 108-120: Withdrawal — equal ease requirement, downstream effects

### ICO Guidance on Consent (UK GDPR)

The UK Information Commissioner's Office published guidance aligning with EDPB Guidelines 05/2020, confirming that UK GDPR consent standards mirror EU GDPR requirements post-Brexit, as incorporated into UK law via the Data Protection Act 2018 and the UK GDPR (retained EU law).

### CNIL Deliberation No. 2020-091 (September 17, 2020)

French guidelines on cookies and similar trackers specifying that:
- Users must be able to refuse cookies as easily as accepting them
- Cookie walls are generally prohibited
- Consent must be renewed at appropriate intervals (maximum 6 months recommended by CNIL)