GDPR Consent Mechanism Guide — Build Compliant Consent

What GDPR Requires for Consent

Under GDPR Article 4(11) and Article 7, consent must be: freely given (no coercion or power imbalance); specific (separate consent for separate purposes); informed (clear language about what is consented to); unambiguous (clear affirmative action — no pre-ticked boxes); and revocable (easy to withdraw, as simple as it was to give). Cookie consent guide →

Consent Mechanisms by Category

Cookie Consent (ePrivacy Directive + Article 7)

Confirmit consent before non-essential cookies load. Categories: strictly necessary (no consent), functional, analytics, marketing. Must provide granular choice — all/nothing is not compliant. Record the consent timestamp, consent string, and user’s IP. CMP comparison →

Marketing Consent (Article 7 + ePrivacy Directive)

Opt-in consent for marketing emails, SMS, or push notifications. Double opt-in recommended as evidence. Separate consent for different marketing channels. Right to withdraw at any time. Newsletter marketing guide →

Explicit Consent (Article 9 for Special Category Data)

For processing health, biometric, genetic, religious, or political data. Requires opt-in + explicit statement — “I explicitly consent” checkbox is standard. Cannot be bundled with general consent.

Consent Records — What to Store

GDPR does not mandate a specific format, but records must demonstrate valid consent at the time of processing. Recommended fields: timestamp (when consent was given), method (checkbox, banner click, email link), text (the exact wording the user agreed to), user identifier (ID, email hash), consent categories, withdrawal timestamp (if applicable). Store consent records for the duration of processing plus the applicable statute of limitations (3-5 years recommended).

Consent and Your EU Representative

Your EU Representative should have access to your consent records in case of a DPA inquiry. EU Shield provides secure storage for consent documentation. Get started from EUR 490/year →