Consent (GDPR)
Consent under the GDPR is a freely given, specific, informed and unambiguous indication of the data subject's agreement to the processing of their personal data. It must be given by a clear affirmative action, such as ticking a box or clicking a button, and must be as easy to withdraw as to give. In the context of political advertising, consent is one of the legal bases that may allow the use of personal data for targeting or ad-delivery techniques.
Legal Basis
"'Consent' of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."
— Article 4(11), Regulation (EU) 2016/679 (GDPR)
Why It Matters
For political advertising, consent is particularly important when online ads use personal data for targeting or ad-delivery techniques. Under Regulation 2024/900 (the Political Advertising Regulation), using personal data to target or deliver political ads is subject to strict conditions, and consent is one of the limited legal bases that may justify such processing.
Sponsors, providers of political advertising services, and online platforms must ensure that any consent obtained meets all GDPR requirements. Pre-ticked boxes, consent bundled with other terms, or consent obtained through deceptive design (dark patterns) are not valid. If consent is withdrawn, the processing must stop immediately, and individuals must be able to withdraw consent as easily as they gave it.
The GDPR's high standard for consent means that many political actors may struggle to rely on it as a legal basis, especially for microtargeting or profiling. This is why transparency obligations under the Political Advertising Regulation apply regardless of the legal basis used, ensuring that citizens know when and how their data is being used in political campaigns.
Key Points
- Freely given: Consent must be a real choice. It cannot be forced, bundled with acceptance of terms, or made a precondition for a service unless strictly necessary.
- Specific and informed: Individuals must know exactly what they are consenting to, including who will process their data and for what purpose.
- Unambiguous: Consent requires a clear affirmative action (e.g., clicking "I agree"). Silence, pre-ticked boxes, or inactivity do not constitute valid consent.
- Revocable: Withdrawing consent must be as easy as giving it. Once withdrawn, data processing must stop.
- Documented: Controllers must be able to demonstrate that valid consent was obtained.
- Special category data: For sensitive data (e.g., political opinions, biometric data), explicit consent is required under GDPR Article 9, with stricter conditions.
Consent vs. Legitimate Interest
Consent and legitimate interest are both legal bases for processing personal data under the GDPR, but they work very differently. Consent requires an active, informed choice by the individual, while legitimate interest allows processing based on the controller's or a third party's interests, provided these do not override the individual's rights. For political advertising, consent gives the individual clear control, but legitimate interest may be harder to justify, especially for intrusive targeting techniques. Under the Political Advertising Regulation, both bases are subject to additional restrictions when processing personal data for targeting or ad-delivery in political campaigns.
| Aspect | Consent | Legitimate Interest |
|---|---|---|
| Individual control | High – individual must actively agree | Lower – processing permitted unless individual objects |
| Transparency requirement | Must explain purpose clearly before consent | Must explain in privacy notice; balancing test required |
| Withdrawal | Must be as easy as giving consent | Right to object at any time |
| Use in political ads | Permitted if valid; strict conditions apply | Harder to justify; must pass balancing test and respect targeting restrictions |