Consent under the GDPR is a fundamental pillar of personal data management, especially in the context of the General Data Protection Regulation (GDPR), as we have discussed in previous articles in this series.
Article 4.11 of the GDPR defines it as follows: “consent of the data subject”: means any freely given, specific, informed and unambiguous indication of his or her wishes by which the data subject signifies his or her agreement, either by a statement or by a clear affirmative action, to the processing of personal data relating to him or her.
In other words, the consent given must be free, specific, informed and unequivocal.
The GDPR consent lifecycle consists of three phases: collection, retention, and withdrawal.
| Phase | Description | Key Obligations | Legal Basis: GDPR |
|---|---|---|---|
| 1. Collection | Obtaining the data subject’s consent in a free, specific, informed, and unambiguous manner | Multichannel, separately for each purpose, without pre-checked boxes, verifiable | Art. 4.11 and Art. 7.1 |
| 2. Custody | Secure and traceable storage of obtained consent | Record including date, channel, and purpose; accessible during audits; protected against unauthorized access | Art. 5.2 and Art. 7.1 |
| 3. Withdrawal | Withdrawal of consent at the request of the data subject | Just as simple as granting consent; confirmation to the user; immediate cessation of processing; updating of records | Art. 7.3 |
Phase 1: Multichannel Collection of GDPR Consent
The collection of consent, as we have indicated above, must be a free, specific, informed and unambiguous action. And it will be up to the controller to demonstrate that the data subject consented to the processing of the data. This means, among other things, that data controllers (i.e. both natural and legal persons) must safeguard the collection of consent.
Regarding the manner of obtaining consent, the entities responsible for the processing will have to offer multiple channels for users to give their consent. In other words, they will adapt to the preferences and needs of the persons concerned. Some common channels are:
- Web forms: allow users to give their consent by completing them online.
- E-mail: through e-mail marketing campaigns, where explicit consent is requested.
- SMS / WhatsApp: text messages requesting users’ consent.
- Mobile applications: the application is carried out from a mobile APP.
- Face-to-face: through physical forms that users can sign in person.
The regulation establishes as mandatory that the consent must be explicit, informed and freely given. Furthermore, it must be specific for each purpose of data processing. This means that it is not valid to collect a single consent for a multitude of purposes, but that each purpose requires a specific consent.
At MailComms, we offer GDPR consulting services to help protect businesses and ensure they know how to obtain consent from their customers and employees properly.
Phase 2: Retention of GDPR Consent
Once obtained, consent must be stored securely and kept accessible by the data controller. Consent record-keeping is the obligation of the data controller to maintain a verifiable, secure, and accessible record of each consent obtained, so that it can be demonstrated at any time that the data subject validly provided consent. This means:
- Secure storage: consents will be stored in secure systems that protect the information against unauthorized access and security breaches.
- Traceability: it is essential to keep a detailed record of when, how and for what purpose consent was obtained. This includes, at a minimum, the date, the channel used and the specific purpose.
- Accessibility: records must be easily consultable in subsequent reviews or audits. This is essential to demonstrate compliance with the GDPR in case of inspections or litigation.
You might be interested in our post on the GDPR and Accountability, where we explain how to meet this obligation to proactively demonstrate compliance with the regulations. In addition, at MailComms, we offer an archiving consulting service that can be a great help to companies that aren’t sure how to store sensitive information about their customers or employees.
Phase 3: Withdrawal of Consent Under the GDPR
Article 7.3 of the GDPR gives individuals the right to withdraw their consent at any time, and requires that it be as easy to give consent as it is to cancel it. Organizations need to build this process in a way that is convenient and free of charge. The design will include:
- Multiple withdrawal channels: multiple channels for users to withdraw their consent, such as web forms, emails, SMS or mobile applications, among other possibilities.
- Confirmation: after withdrawal, the organization has to issue a confirmation and cease any data processing based on that consent.
- Updating records: it is critical that consent records are updated to reflect the withdrawal and to ensure that user data is no longer used for the purposes previously consented to.
Withdrawal of consent will not affect the processing carried out on the basis of consent prior to its withdrawal.
Special attention to the collection of consent for cookies.
Cookies are text files that websites send to the browser to store information about a user’s visit. This allows websites to remember user preferences and provide a more personalized experience. In order to be activated, the user must give their consent.
The Law of Information Society Services and Electronic Commerce (LSSI) regulates the use of cookies in Spain.
Although it does not mention them directly, Article 22.2 of the LSSI states: “Service providers may use data storage and retrieval devices on users’ terminal equipment, provided that they have obtained their consent after providing clear and complete information about their use”.
These are the most important points of the LSSI regarding the regulation of cookies:
- Duty to inform: companies have to inform in a clear and understandable way about the use of cookies: their purpose, duration and who owns them, especially if they are from third parties.
- Obtaining consent: before installing cookies on the user’s device, companies must obtain the user’s explicit consent as indicated in Article 7 of the GDPR. This is usually done by means of banners or pop-ups requesting acceptance.
- Exceptions: some cookies, such as technical cookies, which are necessary for navigation or to provide a service requested by the user, are exempt from the obligation to obtain consent.
| Cookie Type | Purpose | Does it require consent? | Legal basis |
|---|---|---|---|
| (Essential) Techniques | Basic navigation, session, access to secure areas | No, exempt under LSSI Art. 22.2 | Legitimate interest / technical necessity |
| Preferences / Functional | Remember language, region, and user settings | Yes, if they are not strictly necessary | Consent (Art. 7 GDPR) |
| Analytics / Statistics | Measuring website usage, pages visited, conversions | Yes, according to the AEPD (although anonymized data may be treated differently) | Consent or legitimate interest (requires assessment) |
| Marketing / Advertising | Segmentation, retargeting, ad personalization | Yes, always | Explicit consent (Art. 7 GDPR) |
| From third parties | Installed by third-party services (social media, maps, video) | Yes, always | Explicit consent (Art. 7 GDPR) |
Most websites, applications and online platforms use these small code files to improve the browsing experience and/or to collect different types of personal information from users. It is therefore important to follow the following steps for the correct management of consent:
- Transparency: clear information to users about what cookies are, how they are used and for what purpose. This should include an accessible and understandable policy.
- Explicit consent: obtain explicit consent from users before using cookies that are not strictly necessary for the operation of the website.
- Configuration options: provide users with the option to accept or reject different types of cookies, such as performance, functional or advertising cookies.
- Record of consent: keep a record of the consent given by users including the date, time and type of cookies accepted.
- Revocation of consent: allow users to revoke their consent at any time and provide clear instructions on how to do so.
- Updating the cookie policy: periodically review and update the cookie policy to reflect any changes in its use or applicable regulations, among other issues.
The Spanish Data Protection Agency (AEPD) publishes additional guidelines and directives on the use of cookies to ensure compliance with the regulations, and even uses some examples of how some of the above points should be carried out.
Advertising exclusion lists
Advertising opt-out lists are voluntary systems in which individuals can register to avoid receiving unwanted commercial communications from companies with which there is no contractual relationship.
There are currently two advertising exclusion lists: the Robinson List and the Stop Advertising List (newly created).
The companies that carry out commercial actions must exclude those persons who have registered in any of the two lists, that is, in those cases in which the person has consented not to receive this type of communications. They may contact those who are not registered. Consent must be obtained in accordance with article 7 of the RGPD (free, specific, informed and unequivocal), in addition to being given through a channel that allows a record of its collection.
However, anyone who has signed up for an advertising opt-out list may receive advertising from a company if he or she is a customer or if he or she has previously given his or her explicit consent. For example, by making a purchase from a company and agreeing to receive information about similar products, that company may send commercial communications even if the user has signed up for one of these opt-out lists.
Effective consent lifecycle management is essential to comply with data protection regulations, avoid fines, reputational risks and maintain user trust. The consent lifecycle includes multi-channel collection, secure storage and easy opt-out. And transparency and regulatory compliance must be ensured at every stage.
For all these reasons, companies need to have improved and mature consent management processes in place and to rely on technology solutions, such as MailComms Group’s, to help them manage the entire process, ensure compliance and avoid penalties.
And for this compliance, it is very helpful to have a qualified and trusted e-service qualified and trustworthy electronic service provider, such as ours. In addition, we are certified in the main information security and privacy regulations, such as: ISO/IEC 27001 and ISO/IEC 27701, to which we add our accreditation in the high level category in the National Security Scheme.
If you would like to learn about one of the most robust consent management systems on the market, we invite you to contact us.
Frequently Asked Questions
What are the three phases of the GDPR consent lifecycle?
The three phases are: (1) Collection — the data subject provides free, specific, informed, and unambiguous consent through one of the designated channels; (2) Retention — the data controller stores and maintains a secure, traceable, and accessible record of the consent obtained, including all data necessary to demonstrate its validity; and (3) Withdrawal — the data subject may withdraw their consent at any time, just as easily as they gave it, resulting in the immediate cessation of processing and the updating of the records.
Can a company obtain a single consent for multiple purposes?
No. The GDPR requires that consent be specific to each purpose of processing. A generic consent that covers multiple purposes in a single block is not valid. This means that the company must obtain separate and independent consent for each purpose: for example, one for marketing communications, another for profiling, and another for the transfer of data to third parties. Each must be able to be granted and withdrawn independently.
What information must be included in the consent record?
The record must include, at a minimum: the identity of the data subject, the exact date and time of consent, the channel used (website, email, SMS, in person, etc.), the specific purpose for which consent was granted, the version of the privacy notice provided to the user, and the current status of the consent (active or withdrawn, with the date of withdrawal if applicable). This record serves as the evidence that the data controller must present to the AEPD in the event of an inspection or complaint.
What obligations does the right to withdraw consent entail?
When the data subject withdraws their consent, the organization must: (1) confirm to the user that the withdrawal has been processed, (2) immediately cease any data processing based on that consent, (3) update the consent record to reflect the withdrawal, including the date and channel, and (4) ensure that withdrawing consent is as simple and free of charge as granting it. The withdrawal does not retroactively affect processing carried out prior to its exercise.
Do technical cookies require consent under the GDPR?
No. Technical or essential cookies, which are necessary for browsing or for providing a service expressly requested by the user, are exempt from the consent requirement under Article 22.2 of the LSSI. Preference cookies, analytics cookies (according to the AEPD’s criteria), marketing cookies, and third-party cookies do require explicit consent. The AEPD publishes updated guidelines on managing cookie consent.
