Consent is the most demanding lawful basis in the GDPR, and the one most often implemented wrongly. Article 4(11) defines it, Article 7 sets the conditions, and Article 5(3) of the ePrivacy Directive makes it mandatory before non-essential cookies or trackers are set. A banner that collects invalid consent gives you nothing: the processing behind it simply has no legal basis.
| Regulation | GDPR Arts. 4(11), 7; ePrivacy Directive Art. 5(3) |
|---|---|
| Max penalty | EUR 20M or 4% of global annual turnover |
| Enforcing authority | National supervisory authorities, coordinated by the EDPB |
| Official text | EUR-Lex CELEX 32016R0679 |
The four validity tests
Freely given. The individual must have a real choice. Consent bundled with terms of service, extracted through a cookie wall, or obtained in a relationship with a power imbalance fails this test.
Specific. One consent per purpose. A single checkbox covering analytics, advertising, and email marketing is three invalid consents, not one valid one.
Informed. The person must know who is processing, for what purposes, and which third parties are involved, before deciding. A banner that names no vendors while 40 ad-tech companies receive data does not produce informed consent.
Unambiguous. A clear affirmative act. The CJEU held in Planet49 (C-673/17) that pre-ticked boxes are invalid, and recital 32 rules out silence and inactivity.
On top of these, Article 7(3) requires withdrawal to be as easy as giving consent. If accepting takes one click and withdrawing requires finding a settings page, the consent was never valid.
How regulators test banners
Enforcement follows a consistent script. Investigators load the site, count the clicks to refuse versus accept, check whether trackers fire before any choice is made, and compare the vendors disclosed against the vendors actually receiving data. The CNIL used exactly this method for its December 2021 decisions against Google (EUR 150 million) and Facebook (EUR 60 million), and noyb has filed hundreds of complaints across the EU generated by automated banner analysis.
That script is easy to run against your own site. A free privacy scan performs the same checks: which trackers fire pre-consent, what the banner offers, and whether disclosures match observed behavior.
Building a compliant flow
- Block all non-essential tags until a choice is made. Tag managers fire by default; configure explicit blocking.
- Present Accept and Reject with equal prominence on the first layer, purposes on the second.
- Name your vendors and link each to its role. Keep the list synchronized with what actually runs on the site.
- Record every consent event with timestamp, interface version, and choices.
- Offer a persistent way to change or withdraw choices, typically a footer link that reopens the preference center.
- Re-test after every marketing tag change. New pixels added outside the consent platform are the most common way compliant sites drift into violation.
For choosing and configuring a consent platform, see our CMP selection guide.