About this module
Consent fails when it is vague, buried, bundled, or hard to withdraw. This lesson explains valid opt-in in plain terms: the request must be clear, specific, freely given, and recorded. Learners see why pre-ticked boxes, forced consent, and broad wording create compliance risk, especially in marketing. The lesson also covers consent logs, proof of permission, withdrawal handling, and system updates after someone opts out. The point is practical: ask properly, record what happened, and respect withdrawal quickly without punishing the person for changing their mind.
Key takeaways
Welcome to module CS04-06 — Consent: Getting It Right. In this lesson you will learn what makes consent legally valid, the mistakes that make it invalid, and how to document and respect consent in your organisation's day-to-day data practices.
Under GDPR, consent has four non-negotiable qualities. It must be freely given — no pressure or bundled conditions.
It must be specific to a defined purpose. The person must be fully informed before they agree.
And the agreement must be unambiguous — no implied or pre-ticked approval. Valid consent always requires a positive action.
The individual ticks an empty box, reads a clear request, and agrees to one specific purpose. They must also be able to withdraw just as easily.
Invalid consent is surprisingly common. Pre-ticked boxes do not count — regulators are explicit on this.
Neither does hiding consent inside lengthy terms, or asking for blanket agreement to multiple unrelated purposes. This is one of the clearest rules in GDPR.
A pre-ticked box assumes agreement rather than obtaining it. Consent must always be an active, affirmative step by the individual.
If you cannot demonstrate that a person chose to opt in, the consent is void. Granularity is essential.
You cannot ask someone to agree to email marketing, profiling, and third-party sharing with a single tick. Each purpose needs its own consent request and its own withdrawal mechanism.
Bundling purposes together violates the specificity requirement. The first essential is clear language.
Avoid legalese. Write your consent request so that any adult can read it and know exactly what they are agreeing to.
Second, make withdrawal easy. GDPR states that withdrawing consent must be as straightforward as giving it.
A buried unsubscribe link in fine print does not meet that standard. Third, keep consent separate from your terms and conditions.
If agreeing to your T&Cs automatically grants consent, that consent is not freely given and is therefore invalid. Obtaining consent is only half the story — you must also be able to prove it.
Maintain records that capture the individual's identity, the date and method of consent, the version of the consent notice shown, and the specific purposes agreed to. Without this audit trail, you cannot demonstrate compliance to a regulator.
A common mistake is conditioning a service on consent. Telling users they cannot use your app unless they agree to marketing is coercion — that consent cannot be relied on.
Similarly, refusing a discount to someone who opts out is unlawful pressure. Regulators treat these practices seriously, and enforcement action follows.
Before you deploy any consent mechanism, run through this checklist. Is the request isolated from your T&Cs?
Is the language genuinely plain? Does each processing purpose have its own box?
Are there any pre-ticks? Is withdrawal clearly explained?
And will you capture a timestamped record of the consent? Only proceed if you can answer yes to all six.
When someone withdraws consent, your obligations are clear. Stop the processing immediately.
Update your records to reflect the withdrawal. And do not treat the individual differently because they withdrew — that would constitute the kind of penalty that invalidates the original consent.
The financial consequences of getting consent wrong are substantial. In 2023, the UK's Information Commissioner's Office fined three companies a combined total of four and a half million pounds for sending marketing messages without valid consent.
These were not technical breaches — they were systematic failures to collect lawful opt-in from individuals. When you receive a withdrawal, follow these six steps without exception.
Stop processing immediately. Remove the individual from any active lists.
Update every system that holds their consent status. Send confirmation so they know you have acted.
Check whether another lawful basis could apply. And retain the withdrawal record, because regulators may ask to see it.
Three words to take from this module. Ask properly — use clear, specific, ungated requests.
Record it — maintain the audit trail that proves compliance. Respect it — honour withdrawals immediately and without penalty.
Consent is not a legal formality. It is the foundation of trust between your organisation and the people whose data you hold.
