Skip to content
SimpleAct Logo

Guide · GDPR Art. 7, ePrivacy

As of 4 October 2026

Consent Management: Valid Consent under the GDPR and Cookie Rules

Cookie banners, newsletters, talent pools, AI features: wherever you rely on consent, it must be valid and provable. This guide gives you every requirement as a table, when which consent is needed, what to keep as proof and a check that turns gaps into a fix list.

Check your consentSee the requirements
  • Every validity requirement
  • Cookies, newsletters, Art. 9 and transfers
  • What to store as proof
  • Check with fix list
app.simpleact.de

Consents

Cookie banner · website

A
  • Strictly necessaryePrivacy exemption
  • StatisticsConsent
  • MarketingConsent
  • External mediaConsent
Reject allSave selectionAccept all

Latest record

04/10/2026 · 09:41 · visitor a7f3… · statistics · banner v3

Sample data · rejecting as prominent as accepting

In short

Under Art. 4(11) and Art. 7 GDPR, consent is only valid if it is freely given, specific, informed and given by a clear affirmative action. It must be possible to withdraw it at any time as easily as it was given, and the controller must be able to demonstrate it. For cookies, the ePrivacy rules apply on top – in Germany Section 25 TDDDG.

Basics

What makes consent valid – and what consent management means

Consent is one of six legal bases in Art. 6(1) GDPR (point a). The GDPR defines it as any freely given, specific, informed and unambiguous indication of wishes by a statement or a clear affirmative action (Art. 4(11)). If any of these elements is missing, the consent is invalid – and the processing has no legal basis unless another applies.

Art. 7 adds conditions. The controller must be able to demonstrate that consent was given (para. 1). If consent is part of a declaration covering other matters, it must be clearly distinguishable (para. 2). The person can withdraw at any time, is told so beforehand, and withdrawing must be as easy as giving consent (para. 3). And freedom of consent is in doubt where a contract is made conditional on consent to processing not necessary for it (para. 4, often called the "tying ban").

Recital 32 makes "clear affirmative action" concrete: ticking a box or choosing technical settings can be enough; silence, pre-ticked boxes or inactivity do not constitute consent. Where processing serves several purposes, consent is needed for each. The European Data Protection Board (EDPB) states in its Guidelines 05/2020 that scrolling or swiping through a website is not a clear affirmative action.

For cookies and similar technologies, the ePrivacy rules apply in addition – in Germany Section 25 TDDDG (formerly TTDSG). Storing information on, or accessing it from, a user's device requires consent unless it is strictly necessary to provide a digital service explicitly requested by the user, or serves solely to transmit a message over a public telecommunications network. Information and consent follow the GDPR. For cookie walls, where access to content depends on agreeing, the EDPB considers consent not freely given.

For marketing by email, German law (Section 7(2) no. 2 UWG) generally requires prior express consent. An exception applies to existing customers: if you obtained the address in connection with a sale, you may advertise your own similar goods or services as long as the customer has not objected and is reminded of the right to object when the address is collected and every time it is used (Section 7(3) UWG). Other EU countries have similar rules.

Consent management means meeting these requirements permanently: defining purposes, designing texts and banners, storing consents with version and time, applying withdrawals immediately and across all systems. Without proof, consent is effectively not given. According to the EDPB, consent has no fixed expiry; if processing changes significantly, however, it must be obtained again, and the EDPB recommends refreshing consent at appropriate intervals as good practice.

Not every processing operation needs consent – it is often the weaker choice. Where a contract, a legal obligation or a legitimate interest applies, consent is unnecessary and can cause confusion on withdrawal. In employment, the EDPB considers freely given consent possible only in exceptional cases because of the dependency. Choose the legal basis deliberately and record it in your record of processing.

elements: freely given, specific, informed, unambiguous (Art. 4(11))
4
elements: freely given, specific, informed, unambiguous (Art. 4(11))
years: age limit for online services offered to children, can be lowered nationally to 13 (Art. 8)
16
years: age limit for online services offered to children, can be lowered nationally to 13 (Art. 8)
or 4% of turnover: fine ceiling for breaches of Art. 6, 7, 9 (Art. 83(5))
€20m
or 4% of turnover: fine ceiling for breaches of Art. 6, 7, 9 (Art. 83(5))

Requirements

When consent is valid: every requirement

The elements of Art. 4(11) and the conditions of Art. 7 and 8 GDPR – with the most common mistakes in practice.

Freely given
What it meansGenuine choice without detriment; no clear imbalance; separate consent for different operations where appropriate
Typical mistakeAccess to content only after agreeing (cookie wall)
ReferenceArt. 4(11); rec. 42, 43
Tying ban
What it meansDo not make a contract conditional on consent to processing that is not necessary
Typical mistakePrize draw only with consent to third-party marketing
ReferenceArt. 7(4)
Specific
What it meansConcrete purpose; one consent per purpose where there are several
Typical mistake"For marketing purposes and partners" without detail
ReferenceArt. 4(11); rec. 32
Informed
What it meansAt least: who the controller is and for which purposes data is processed
Typical mistakeVendors or recipients only visible after the click
ReferenceArt. 4(11); rec. 42
Unambiguous, active
What it meansClear affirmative action; no silence, no pre-ticked box, no inactivity
Typical mistakePre-selected boxes, "continuing to browse means consent"
ReferenceArt. 4(11); rec. 32
Clearly distinguishable
What it meansDistinguishable within a declaration covering other matters, intelligible and in plain language
Typical mistakeConsent hidden in terms and conditions
ReferenceArt. 7(2)
Withdrawal any time, easily
What it meansWithdrawal as easy as giving consent; inform beforehand; effective for the future
Typical mistakeConsent by click, withdrawal only by letter
ReferenceArt. 7(3)
Demonstrable
What it meansThe controller must be able to prove consent
Typical mistakeNo log, no text version stored
ReferenceArt. 7(1)
Children and online services
What it meansUnder 16, parental consent; member states can lower to 13; reasonable verification
Typical mistakeNo age check for a service aimed at children
ReferenceArt. 8
Explicit in special cases
What it meansExplicit consent for special categories, automated decisions and certain third-country transfers
Typical mistakeHealth data with a general tick box
ReferenceArt. 9(2)(a); Art. 22(2)(c); Art. 49(1)(a)

If you rely on consent, you must also meet Art. 13 and point out the right to withdraw (Art. 13(2)(c)).

Use cases

When you need which consent

Common situations and the provisions requiring consent. UWG and TDDDG are German law. Whether another legal basis applies in the individual case must be checked separately.

Cookies and tracking, not strictly necessary
Consent needed?Yes
NoteThe GDPR also applies to the subsequent processing of personal data
ProvisionSection 25(1) TDDDG; Art. 6(1)(a) GDPR
Strictly necessary cookies
Consent needed?No
NoteOnly for a service explicitly requested; do not show as a tick box in the banner
ProvisionSection 25(2) no. 2 TDDDG
Email newsletter to new customers
Consent needed?Yes, prior express
NoteDouble opt-in helps with proof
ProvisionSection 7(2) no. 2 UWG; Art. 7 GDPR
Email marketing to existing customers
Consent needed?Not necessarily
NoteOnly own similar products, address from a sale, right to object pointed out at every use
ProvisionSection 7(3) UWG
Telephone marketing to consumers
Consent needed?Yes, prior express
NoteFor businesses, at least presumed consent is enough
ProvisionSection 7(2) no. 1 UWG
Health data or other special categories
Consent needed?If no other exception applies: explicit
NoteCheck other exceptions in Art. 9(2)
ProvisionArt. 9(2)(a) GDPR
Applications in a talent pool
Consent needed?Usually yes (recommendation)
NoteBeyond the specific procedure; state the duration
ProvisionArt. 6(1)(a) GDPR
Third-country transfer without another basis
Consent needed?Yes, explicit, after being informed of the risks
NoteAn exception, not the rule – Art. 45, 46 first
ProvisionArt. 49(1)(a) GDPR
Solely automated decision
Consent needed?One of three exceptions: explicit
NoteThen secure the right to human intervention (para. 3)
ProvisionArt. 22(2)(c) GDPR

Other countries apply their own implementations of the ePrivacy Directive.

Interactive

Consent check: is your consent valid?

Take one concrete consent flow – cookie banner, newsletter form, talent pool – and answer twelve questions. On the right you see what is missing and a fix list to pass on. Nothing is stored or transmitted.

  • Affirmative action

    Consent by click or selection, no pre-ticked boxes. Art. 4(11), rec. 32

  • Browsing is not consent

    Scrolling, swiping or closing does not count as consent. EDPB 05/2020

  • Rejecting as easy as accepting

    Equivalent reject option on the same level – otherwise the choice is not free. Art. 4(11), rec. 42; supervisory interpretation (EDPB cookie banner taskforce 2023)

  • No compulsion

    Content or service available without consent. Art. 7(4), EDPB 05/2020

  • Purposes selectable separately

    Separate consent per purpose possible. Rec. 32, 43

  • Controller and purposes named

    Visible before consent, including recipients/vendors. Art. 4(11), rec. 42

  • Separate from other declarations

    Not hidden in terms or contract text. Art. 7(2)

  • Withdrawal explained beforehand

    Informed about the right to withdraw before consenting. Art. 7(3), 3rd sentence

  • Easy withdrawal at any time

    Same channel, same effort, e.g. link or reopening the banner. Art. 7(3)

  • Proof stored

    Who, when, to what, which text version. Art. 7(1)

  • Withdrawal applied technically

    After withdrawal, data is no longer used for the purpose. Art. 7(3), Art. 17(1)(b)

  • Special cases covered

    Explicit for Art. 9, children under 16 for online services. Art. 8, Art. 9(2)(a)

app.simpleact.de

Result

0 of 12 questions answered

A

Answer all questions to see a complete result.

A working aid for orientation, not legal advice. Whether consent is valid depends on the specific case.

Proof

What to store as proof of consent

Art. 7(1) requires proof but prescribes no format. These details have proven useful – that is our recommendation. Store only as much as the proof requires.

Who
What forLink to the person or device
ExampleCustomer ID, email address, pseudonymous visitor ID
When
What forTime consent was given
ExampleDate and time with time zone
To what
What forPurposes and categories agreed to
Example"Statistics", "Newsletter product news"
Which text
What forWording and version of the consent text or banner
ExampleBanner v3 of 1 Sep 2026
How
What forChannel used
ExampleCheckbox in a form, confirmation link (double opt-in), banner click
Information
What forWhich notices were shown
ExampleLink to the privacy notice in the version at the time
Withdrawal
What forTime and channel of any withdrawal
ExampleUnsubscribe link on 12 Nov 2026

According to the EDPB, consent you cannot prove does not meet the GDPR standard and must be obtained again.

Consent and AI

Consent for AI features: what matters

AI features raise their own consent questions. These points are our assessment and recommendation – choosing the legal basis remains a case-by-case decision.

01

Choose the legal basis deliberately

Not every AI feature needs consent. If you base processing on consent, you must be able to handle withdrawals – technically too.

02

New purpose, new consent

Consent is specific. If data collected for another purpose is now to feed an AI analysis, the old consent does not automatically cover it.

03

Training on customer data

If inputs or data are to be used for training, the person must be able to see that in advance. Check how a withdrawal is handled once data has gone into a model.

04

Automated decisions

Where a system makes solely automated decisions with legal effect, explicit consent is one of the three exceptions (Art. 22(2)(c)) – with the right to human intervention.

05

Special categories in free text

Health or other Art. 9 data quickly ends up in chat and form fields. If processing it relies on consent, consent must be explicit (Art. 9(2)(a)).

06

Employees

In employment, the EDPB considers consent freely given only exceptionally. For AI tools at work, other legal bases and employee representation are usually the better route.

The AI Act creates no consent of its own for data processing; legal bases remain a matter for the GDPR.

Approach

Building consent management in 6 steps

From sprawl to a provable process. The order is a recommendation from practice.

  1. 1

    Inventory consents

    Where do you collect consent? Website, forms, newsletter, applications, apps, events. Your RoPA shows which processing relies on Art. 6(1)(a).

  2. 2

    Check the legal basis

    Is consent really needed, or does contract, legal obligation or legitimate interest apply? Drop unnecessary consents.

  3. 3

    Design texts and banners

    Separate purposes, name the controller and recipients, explain withdrawal, offer rejection on equal terms. Version your texts.

  4. 4

    Secure proof technically

    Store time, purposes, text version and channel for each consent – sparingly, for example with a pseudonymous ID.

  5. 5

    Apply withdrawals

    A withdrawal must reach every system: newsletter tool, CRM, analytics, providers. Maintain suppression lists.

  6. 6

    Review regularly

    With new tools, purposes or vendors, update texts and obtain new consent where needed. The EDPB recommends refreshing consent at appropriate intervals.

Withdrawal

Withdrawal: as easy as giving consent

The data subject can withdraw consent at any time (Art. 7(3)). Withdrawal works for the future: processing carried out until then remains lawful. The person must be informed of this right before giving consent.

The decisive sentence is the last one of Art. 7(3): withdrawing must be as easy as giving consent. If consent is given by a click, withdrawal cannot require a letter, a hotline or a hidden form. For cookie banners this means the settings must be reachable again at any time, for example via a permanent link.

After withdrawal, processing for that purpose must stop. Data without another legal basis must be erased (Art. 17(1)(b)). Document the withdrawal itself – it is part of the proof that you manage consent properly.

  • At any time, no reason needed
  • Same channel, same effort as giving consent
  • Effective for the future
  • Erase data without another basis (Art. 17(1)(b))
  • Document the withdrawal

Common mistakes

Six mistakes in consent management

Pre-selected boxes

Pre-ticked boxes are not consent (recital 32). Every purpose starts switched off.

Rejection hidden

"Accept all" as a big button, reject only on the second layer – that puts freedom of consent at risk.

No proof

Without stored time, purpose and text version, consent cannot be proven in a dispute.

Withdrawal does not reach all systems

Unsubscribed in the newsletter tool but still in the CRM list: withdrawal must arrive everywhere.

Consent where none is needed

Asking for consent to perform a contract creates false expectations – and trouble on withdrawal.

Old consent for a new purpose

Consent is specific. New purposes, such as AI analyses, need a new basis.

With SimpleAct

Consents in SimpleAct

The GDPR module (from Professional) keeps consent purposes and records separately – and configures your cookie banner from them.

  • Purposes with category, legal basis, provider, cookie name, retention
  • Labels per language (DE/EN)
  • Banner shows exactly the active purposes
  • Records with visitor ID, categories and time
  • IP address stored only as a hash, not in clear text
  • Export of records as CSV, filterable by period

Proof without data collection

Proof of consent should not create more data than the processing consented to. That is why SimpleAct stores technical context only in shortened form.

See the GDPR module

FAQ

Frequently asked questions about consent management

When it is freely given, specific, informed and unambiguous, by a statement or clear affirmative action (Art. 4(11)). The conditions in Art. 7 apply on top: demonstrability, clear distinction from other declarations, withdrawal at any time and as easily as given, no tying.
No. Under the ePrivacy rules (in Germany Section 25(2) TDDDG), no consent is needed if the cookie is strictly necessary to provide a digital service explicitly requested by the user, or serves solely to transmit a message over a public telecommunications network. Statistics, marketing and similar cookies usually require consent.
No. Recital 32 makes clear that silence, pre-ticked boxes or inactivity do not constitute consent. Scrolling or swiping through a website is not enough either, according to EDPB Guidelines 05/2020.
According to EDPB Guidelines 05/2020, consent is not freely given if access to services or functionalities depends on the user agreeing to information being stored on their device. Such a cookie wall does not support valid consent.
The GDPR sets no fixed period. According to the EDPB, the duration depends on the context and scope of the original consent. If processing changes significantly, new consent is needed. As good practice the EDPB recommends refreshing consent at appropriate intervals.
Art. 7(1) requires proof but prescribes no format. Useful details: who consented, when, to what, with which text in which version and through which channel – and any later withdrawal. For newsletters, double opt-in helps.
Under German law, under the conditions of Section 7(3) UWG: the address comes from a sale, you advertise your own similar goods or services, the customer has not objected and is clearly reminded of the right to object when the address is collected and at every use.
Only exceptionally. Because of the dependency, the EDPB considers freely given consent in employment possible only where refusing has no adverse consequences at all. For most processing in the employment context, other legal bases are preferable.
For online services offered directly to children, the age limit under Art. 8 GDPR is 16. Member states may lower it to as low as 13. Below the limit, parental consent is needed and the provider must make reasonable efforts to verify it.
Processing for the purpose must stop; processing until then remains lawful. Data without another legal basis must be erased (Art. 17(1)(b)). The withdrawal must be applied in every system involved.

More questions? We're happy to help. Send email · Try 7 days (credit card required)

Sources and status

As of · SimpleAct editorial team

This guide is general information and not legal advice. TDDDG and UWG are German law; whether consent is valid depends on the specific case.

Changes

  • 2026-10-04 – Page rebuilt: requirements, use cases, proof, consent check with fix list, AI section, withdrawal.
  • 2026-06-14 – First version.

Related topics

Prove consent without collecting more data

SimpleAct manages consent purposes, configures the banner and stores lean proof records. Try 7 days (credit card required) or book a demo.

Book a demoTry 7 days (credit card required)