What counts as valid consent, and when do you need it?

What it is

Consent is one of the seven lawful bases. It puts people in control, but it is fragile: they can withdraw at any time, and it is rarely valid where there is a power imbalance, such as between employer and employee or public authority and citizen. Pre-ticked boxes, silence and bundled terms are not consent. For online services offered directly to children, a child aged 13 or over can consent; below that, a parent must.

When you need consent

• Where no other lawful basis applies to the purpose. UK GDPR Art 6(1)(a)
• To rely on explicit consent for special category data, or to make a solely automated significant decision using special category data. Art 9(2)(a); Art 22B
• To send electronic marketing to individuals, unless the soft opt-in applies. PECR reg 22
• To store or access information on a device beyond the PECR exceptions, such as advertising cookies. PECR reg 6

When consent will not work

• Where you would process anyway if the person said no: use a different basis.
• Where the person cannot refuse without detriment, such as most employment processing. Art 7(4)

Who is responsible

The controller, which must be able to show that consent was given and keep records of who consented, when, how and to what.

What it involves

1. Ask separately from other terms, in plain language.
2. Name your organisation and any third parties relying on it.
3. Use an unticked opt-in or other clear action.
4. Record the consent.
5. Make withdrawal as easy as giving it, and act on it.
6. Refresh consent when purposes change. For scientific research, consent can cover an area of research from 2026-02-05.

If it goes wrong

Regulatory

Invalid consent means no lawful basis. A breach sits in the higher tier of penalties: up to £17.5 million or 4% of annual worldwide turnover, whichever is higher (DPA 2018 s.157). The regulator can also issue a reprimand or an enforcement notice ordering the processing to stop or change. For marketing and cookies, PECR penalties now reach the same levels.

Criminal

No offence.

Civil

Anyone who suffers material or non-material damage, including distress, because of the infringement can claim compensation from the controller or processor in the county court or High Court (sheriff court or Court of Session in Scotland) under Art 82 and DPA 2018 s.168.