Valid consent: four pillars, one trap

Under GDPR, valid consent isn't just a tick in a box—it must meet four cumulative conditions. 'Freely given' means the data subject has a genuine choice, without pressure or penalty for refusing. 'Specific' requires consent for each distinct processing purpose, not a blanket agreement. 'Informed' demands clear, plain-language explanation of what data is collected and why. 'Unambiguous' means the individual's indication must be clear, such as an active opt-in, not silence or pre-ticked boxes. For example, a website that bundles consent for analytics, marketing, and third-party sharing into one checkbox fails the 'specific' and 'freely given' tests.

To spot invalid consent quickly, look for any lack of real choice: pre-ticked boxes, bundled consent with terms of service, or withdrawal penalties. If a question describes a scenario where consent is buried in small print or combined with other requests, it's likely invalid. Another trick: remember that silence or inactivity never counts as unambiguous consent—GDPR requires an active, affirmative action. In exams, if a data controller claims consent from a pre-ticked box, you can immediately flag it as a violation of the 'freely given' and 'unambiguous' requirements.

Use the mnemonic 'FSIU' (Freely given, Specific, Informed, Unambiguous) to recall the pillars. To test yourself, imagine a consent form: if you can't easily say 'no' without consequence, or if the form mixes purposes, the consent fails. Practice by rewriting a bundled consent statement into a valid one, separating each purpose into its own opt-in. This active exercise cements the distinction between valid and invalid consent.