consent
Consent is your voluntary, specific, informed, and explicit permission allowing a company or service to process your personal data for a defined purpose.
In plain terms
Consent is like lending your apartment key to a neighbor so they can water your plants. You decide whether to give it, specify how it can be used, and can request it back at any time. If the neighbor throws a party in your living room, you did not grant permission for that.
The same logic applies in data protection: if a company relies on your consent, it can only use your data for what you explicitly agreed to. Consent only counts if it was clearly explained beforehand what it concerns, and if there is no disadvantage for refusing.
In the AI era, this has become more important because your data can become not just a newsletter mailing list but also training material for a model. Moreover, an AI agent can read your emails, calendar, or invoices on your behalf, so it matters exactly what permissions you granted it.
Consent is not the only legal basis a company can rely on. Data processing can be based on a contract, a legal obligation, or the company's legitimate interest. In such cases, no separate consent is requested from you.
How it works
- Information: the company states in advance, in understandable terms, what data it will process, for what purpose, for how long, and to whom it will disclose it.
- Active decision: you must take an action, such as checking an empty box or pressing a button. A pre-checked box, silence, or mere scrolling does not count as consent.
- Consent is required separately for each purpose: agreeing to a newsletter does not mean your data can be used to train an AI model.
- Proof: the company must be able to prove when and for what you gave consent, so it logs this.
- Withdrawal: you may change your mind at any time, and this must be as simple as saying yes. Withdrawal applies to the future and does not render prior data processing unlawful retroactively.
An everyday example
You download an AI assistant that offers to go through your inbox and reply to emails on your behalf. Before it starts, a window pops up asking whether you allow it to read your emails and, as a separate question, whether your conversations may be used to improve the model. You can say yes to the first and no to the second, and the application must still work.
Who is affected
A common misconception
Limits and risks
- Long information sheets written in legal language are rarely read, so in practice many 'yes' responses stem from habit rather than genuine consideration.
- If your data has already been used to train an AI model, it cannot be simply erased from the trained model even after withdrawal.
- Where you have no real choice, such as against an employer or an authority, consent is generally not considered voluntary, so it is usually not an appropriate legal basis there.
- Deceptive interfaces, such as a hidden "Decline" button or a glaring "Accept" button, can steer you toward a consent you did not actually intend to give.
Similar, but not the same
- legitimate interest – In cases of legitimate interest, the company processes your data without your consent. It must first weigh whether its interest outweighs your rights. You can object to this; in the case of direct marketing, the company may no longer use your data for this purpose after your objection.
- acceptance of terms of use – By accepting the terms, you enter a contract with the provider, whereas the data processing consent is a separate, independently given and revocable statement.
- informed consent (medical) – Medical consent is for performing an intervention, while data protection consent is for processing your data, and the two are governed by different rules.
Related concepts
data protection, General Data Protection Regulation, legal basis for data processing
cookie consent, explicit consent, parental consent
legitimate interest, personal data, right to object, right to erasure, dark pattern
A brief history
Consent was already a legal basis in the 1995 European data protection directive. Its stricter present-day conditions are set out in the General Data Protection Regulation (GDPR), adopted in 2016 and applicable since 25 May 2018. In 2019, in the Planet49 case, the Court of Justice of the European Union ruled that a pre-ticked box is not valid consent.
Where things stand
By the end of 2026, consent is an established, everyday tool in European data protection. The current debate focuses on when consent is required for training AI models and for data access by autonomous agents, and when other legal bases, such as legitimate interest, suffice. The European Data Protection Board's 2024 opinion states that legitimate interest may apply to AI model training under certain conditions. In November 2025, the European Commission proposed simplifying the GDPR and cookie rules.
In the news
- Lawsuit says AHN and Highmark recorded patients with Abridge AI without proper consentOct 31, 2026 · Health
- Mastercard's Hungarian expert: by 2030 the AI agent pays and the token verifiesOct 26, 2026 · Money
- Amazon's new AI devices can listen to conversations and suggest purchases if users opt inOct 19, 2026 · Marketing
- EU backs GDPR change letting AI use personal data without consentOct 19, 2026 · Jog
- Proposed class action: OpenAI used children's data to train ChatGPT without parental consentOct 13, 2026 · Education & Family
- Class action: OpenAI let minors sign up without parental consent and used their data for trainingOct 13, 2026 · Jog
- Lawsuit over AI-altered influencer appearance, while India's SEBI keeps its AI influencer approval ruleOct 12, 2026 · Marketing
- AI agents challenge payment intent verification and fraud liabilityOct 12, 2026 · Money
Also known as
consent · data processing consent · data subject consent · consent · consent · data protection consent · GDPR consent · opt-in
Sources
This entry was machine-edited and has undergone machine expert review; the “In the news” section updates automatically from Agent Age stories.