--- title: "Art. 7 GDPR: Conditions for consent" canonical: "https://dposchool.com/gdpr/article/7" source: "https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_7" source_note: "Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en" publisher: "DPO School" --- Art. 7 GDPR · Chapter II: Principles # Article 7 GDPR: Conditions for consent Text as of 28 October 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/gdpr/about#review) ## Summary (not the official text) Where processing is based on consent, the controller must be able to show that consent was given, a request for consent must be clearly distinguishable and in plain language, and the data subject may withdraw consent at any time, as easily as it was given. When assessing whether consent is freely given, utmost account is taken of whether a contract is made conditional on consent to processing that is not necessary for that contract. ## Official text ### Article 7(1) **1.** Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. ### Article 7(2) **2.** If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. ### Article 7(3) **3.** The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. ### Article 7(4) **4.** When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. ## Source Source: Regulation (EU) 2016/679, Official Journal L 119, 4.5.2016, as corrected. Only the text published in the Official Journal is authentic. © European Union, https://eur-lex.europa.eu [Article 7 on EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/HTML/?uri=CELEX:32016R0679#art_7) Text as of 28 October 2026. This is reference material, not legal advice. ## Related recitals This list is under review. - [Recital 32](https://dposchool.com/gdpr/recital/32) - [Recital 42](https://dposchool.com/gdpr/recital/42) - [Recital 43](https://dposchool.com/gdpr/recital/43) ## Court of Justice judgments ### [C-252/21, Meta Platforms Inc and Others v Bundeskartellamt](https://dposchool.com/gdpr/case/c-252-21) Judgment of 4 July 2023 · ECLI:EU:C:2023:537 A competition authority may find GDPR breaches when examining abuse of dominance, in cooperation with data protection authorities; collecting off-platform data that reveal sensitive traits is special-category processing; personalised advertising from such data cannot rest on contract necessity and only narrowly on legitimate interest; dominance does not bar valid consent but weighs on whether it is freely given. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-252/21&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62021CJ0252) ### [C-61/19, Orange Romania SA v Autoritatea Naţională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)](https://dposchool.com/gdpr/case/c-61-19) Judgment of 11 November 2020 · ECLI:EU:C:2020:901 The controller must prove that consent was given by active behaviour after clear information; a contract with a pre-ticked box for storing ID copies does not show valid consent, nor does a form that makes refusal harder. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-61/19&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62019CJ0061) ### Related (earlier law or other instruments) #### [C-673/17, Bundesverband der Verbraucherzentralen und Verbraucherverbände - Verbraucherzentrale Bundesverband e.V. v Planet49 GmbH](https://dposchool.com/gdpr/case/c-673-17) Judgment of 1 October 2019 · ECLI:EU:C:2019:801 Instrument: GDPR together with the ePrivacy Directive (Art. 5(3)) A pre-ticked checkbox does not give valid consent to cookies, whether or not the data are personal data; users must be told how long cookies last and whether third parties can access them. [CURIA](https://curia.europa.eu/juris/liste.jsf?num=C-673/17&language=en) · [EUR-Lex](https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX:62017CJ0673) ## EDPB guidance ### [Joint Guidelines (European Commission and EDPB) on the interplay between the Digital Markets Act and the GDPR](https://dposchool.com/gdpr/guidance/edpb-com-dma-gdpr) EDPB-COM DMA/GDPR · Draft for consultation · First published 9 October 2025 Joint text; consultation closed 4 December 2025; final not yet published. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/joint-guidelines-on-the-interplay-between-the-digital-markets-act-and-the_en) ### [Opinion 08/2024 on valid consent in the context of consent or pay models implemented by large online platforms](https://dposchool.com/gdpr/guidance/edpb-opinion-08-2024) EDPB Opinion 08/2024 · Final · First published 17 April 2024 · Final version 17 April 2024 Art. 64(2) opinion; date is EDPB publication date. [Document on the EDPB website](https://www.edpb.europa.eu/documents/opinion-of-the-board-art-64/opinion-082024-on-valid-consent-in-the-context-of-consent-or_en) ### [Guidelines 03/2022 on deceptive design patterns in social media platform interfaces](https://dposchool.com/gdpr/guidance/edpb-03-2022) EDPB 03/2022 · Final · First published 21 March 2022 · Final version 24 February 2023 Version 1 was titled 'dark patterns'. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-032022-on-deceptive-design-patterns-in-social-media-platform_en) ### [Guidelines 05/2020 on consent under Regulation 2016/679](https://dposchool.com/gdpr/guidance/edpb-05-2020) EDPB 05/2020 · Final · First published 4 May 2020 · Final version 4 May 2020 Supersedes WP29 WP259 rev.01. Covers children's consent under Art. 8. [Document on the EDPB website](https://www.edpb.europa.eu/documents/guideline/guidelines-052020-on-consent-under-regulation-2016679_en) ## Fines Amounts are shown in the currency in which the fine was imposed. ### [CRITEO: EUR 40,000,000](https://dposchool.com/gdpr/fine/cnil-criteo-2023-06) Commission nationale de l'informatique et des libertés (CNIL), France · Decision of 15 June 2023 · Appeal status: unknown Ad-tech company could not show that the people whose browsing data it processed had consented, gave incomplete information, mishandled access, withdrawal and erasure requests, and lacked a proper joint-controller arrangement with partners. [Source: the authority](https://www.legifrance.gouv.fr/cnil/id/CNILTEXT000047707063) ### [TIM S.p.A.: EUR 27,802,946](https://dposchool.com/gdpr/fine/garante-tim-2020-01) Garante per la protezione dei dati personali, Italy · Decision of 15 January 2020 · Appeal status: unknown Aggressive telemarketing: calls to people who had refused or were on internal block lists, marketing without valid consent, and weak control of call-centre partners. Not fully confirmed: Amount, date and name read in the decision (register no. 7 of 15 January 2020). Articles listed are those the decision states for its main finding (section 3.1, which also cites Article 130 of the Italian Code); later sections discuss further provisions (e.g. Articles 12 and 21), so the list may be incomplete. [Source: the authority](https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/9256486) ## Navigation [GDPR Navigator](https://dposchool.com/gdpr) / [Chapter II](https://dposchool.com/gdpr/chapter/2) / Article 7 Previous: [Art. 6 GDPR: Lawfulness of processing](https://dposchool.com/gdpr/article/6) Next: [Art. 8 GDPR: Conditions applicable to child's consent in relation to information society services](https://dposchool.com/gdpr/article/8) Studying the GDPR? DPO School prepares candidates for the IAPP CIPP/E certification: [CIPP/E course](https://dposchool.com/courses/cipp-e). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/gdpr/llms.txt - JSON API: https://dposchool.com/gdpr/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents