In one sentence. GDPR Article 7 sets out four conditions that elevate consent (defined in Article 4(11)) to a valid lawful basis: (1) the controller must be able to demonstrate consent was given, (2) the consent request must be intelligible and clearly distinguishable from other matters, (3) the data subject must be able to withdraw consent as easily as they gave it, and (4) consent must be freely given — with a real choice and no inappropriate conditioning of the service on optional processing.
Article 7 is what makes Article 6(1)(a) operational. Practical failures include missing evidence, a withdrawal route harder than the opt-in, or optional processing bundled into service terms.
For practical wording examples, see GDPR consent wording examples. For the broader lawful basis framework, GDPR Article 6 lawful basis guide.
Key takeaways
- Article 7 elevates consent from “any agreement” to demonstrable, distinguishable, withdrawable, and freely given consent.
- Burden of proof is on the controller — keep timestamped records of every consent.
- Withdrawal must be as easy as giving consent — a genuinely accessible route, without additional cost or unjustified obstacles.
- “Freely given” requires separate optional choices and assessment of power imbalances and service conditionality; employment consent is exceptional, not categorically impossible.
- Article 7 falls within Article 83(5): the upper limit is EUR 20 million or, for an undertaking, 4% of worldwide annual turnover, whichever is higher; the actual penalty depends on the case.
1. Article 7 text
Article 7 — Conditions for consent
Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.
If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.
The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.
When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.
2. Condition 1 — Demonstrability (Article 7(1))
The controller must keep proof of consent. The record must connect the affirmative choice with the person, purpose and information shown; the GDPR does not prescribe one mandatory database format.
What “demonstrable” means in practice:
- Who consented (user ID, email, hash)
- When consent was given (timestamp)
- What they consented to (specific purpose + version of the consent text)
- How they consented (channel: web form, in-app, paper)
Storage: typically in a consent management platform (CMP) or in your own consent table — our GDPR consent management guide covers the architecture options. The consent log must persist as long as the consent is in effect.
Common failure: a CRM checkbox saying “marketing OK” with no record of when or what version of the privacy notice was shown.
3. Condition 2 — Intelligible and distinguishable (Article 7(2))
The consent request must be:
- Clearly distinguishable from other matters (terms of service, contract clauses)
- Intelligible — a typical user understands what they’re agreeing to
- Easily accessible — not buried, not requiring expansion of multiple links
- Clear and plain language — no legalese
In Planet49 (C-673/17, 1 October 2019), the CJEU rejected pre-ticked cookie consent because it did not establish active consent. The ruling concerns the ePrivacy consent requirement read with the relevant consent definitions, including Article 4(11) GDPR; it is not a ruling that pre-ticking is simply a failure to distinguish the request under Article 7(2).
Common failures:
- “I accept the terms and conditions and consent to marketing” → bundling
- Single checkbox covering 5 different processing purposes → not specific
- Consent notice in 8pt grey font at the bottom of a form → not accessible
- “By clicking Subscribe you accept the terms” → not clearly distinguishable
4. Condition 3 — Withdrawal as easy as giving consent (Article 7(3))
If the user can opt in through a simple online action, withdrawal must be equally easy — not “send an email to dpo@…, wait for confirmation, then we’ll process within 30 days.”
Compliant withdrawal mechanisms:
- One-click unsubscribe link in every marketing email
- “Cookie preferences” link in footer that re-opens the CMP banner
- “Disable” toggle in account settings that stops the consent-based use
- Identity-verified portal action
Withdrawal designs to avoid:
- Postal mail required to withdraw email marketing consent
- Phone call to a paid customer service line
- Account deletion as the only way to opt out of optional processing
- Continuing consent-based processing after withdrawal while treating the request as an ordinary month-long rights workflow
The user must also be informed before consent that withdrawal is possible and how. Hidden withdrawal mechanisms invalidate the original consent.
5. Condition 4 — Freely given (Article 7(4))
Consent is not freely given if:
- Service is conditional on consent to processing not necessary for that service. Example: a free email app that requires consent to behavioral advertising — not free if you can’t use the email otherwise.
- Power imbalance exists — typically employer-employee. The EDPB has stated that consent in an employment context is almost never valid, except for genuinely optional perks with no consequence on refusal.
- Multiple purposes are bundled — one consent for “improve our service AND share with partners AND advertise to you” is invalid.
- Detrimental consequences flow from refusal beyond the strict service impact.
Cookie walls require a case-specific assessment of genuine choice, equivalence and detriment. A paid alternative alone does not establish valid consent. The EDPB opinion on large online platforms has that specific scope; it does not set a generally acceptable subscription price.
6. Enforcement landscape
Article 83(5)(a) places infringements of the basic processing principles, including consent conditions under Article 7, in the upper fine tier. A specific enforcement example must be checked against the actual decision, infringed provisions and procedural status. A transparency, retention or security fine is not evidence of an Article 7 infringement merely because it concerns a digital service.
7. Implementation checklist
- ☐ Consent recorded with: user ID, timestamp, purpose, version of the privacy notice
- ☐ Consent UI distinguishes the consent request from terms of service
- ☐ One purpose = one consent (no bundling)
- ☐ Pre-ticked boxes removed everywhere
- ☐ Withdrawal mechanism documented and tested across the systems using the consent
- ☐ User informed of withdrawal mechanism before consenting
- ☐ Service access not conditioned on optional consent
- ☐ Employer-employee consent reviewed by DPO (rarely valid)
- ☐ Cookie wall (if used) has a documented assessment of genuine choice and equivalent alternatives
- ☐ Consent records retained as long as consent is active + reasonable evidence period after withdrawal
8. Article 7 vs Article 4(11): definition vs conditions
Article 4(11) defines consent: “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement.”
Article 7 sets the operational conditions to keep that consent valid over time. The two work together — Article 4(11) tells you what consent is; Article 7 tells you what to do to preserve it.
9. Tooling
A CMP can help record choices and apply configured tag rules. Evaluate whether its actual configuration preserves the consent evidence and propagates withdrawal; software does not decide whether consent is freely given.
For related guides: GDPR consent wording examples, GDPR Article 6 lawful basis, opt-in opt-out guide, bandeau cookies CNIL (FR).
Official sources: Article 7 (conditions for consent) of Regulation (EU) 2016/679 on EUR-Lex, the EDPB Guidelines 05/2020 on consent, and the ICO guidance.
Conclusion
Article 7 is the operational discipline behind consent. The four conditions — demonstrability, intelligibility, withdrawability, freedom — read short but each requires a system: a consent log, a UI design, a withdrawal flow, and an architectural choice not to bundle. The review must distinguish GDPR consent conditions from the separate national rules implementing ePrivacy.
FAQ
What is GDPR Article 7?
Article 7 sets four conditions for consent to be valid as a lawful basis: it must be demonstrable, intelligible and clearly distinguishable, withdrawable as easily as given, and freely given.
Does Article 7 apply to all consent under GDPR?
Yes — whenever consent is invoked as the lawful basis under Article 6(1)(a) or as the explicit consent condition under Article 9(2)(a), Article 7 conditions apply.
Can I require consent to use my service?
Assess the actual choice under Article 7(4), especially whether service performance depends on consent to unnecessary processing. Processing necessary for a contract may rely on Article 6(1)(b) if its conditions are met; do not use a forced consent box as a substitute for selecting the correct lawful basis. Consent-or-pay arrangements need the separate assessment described above.
How long must I keep consent records?
Keep sufficient evidence while relying on consent. After withdrawal, determine and document any justified retention needed to demonstrate past compliance or handle claims, with restricted use and access. Article 7 does not prescribe a universal 24–36-month period; do not confuse an evidence record with permission to continue marketing.
Can employees give valid consent?
The EDPB has stated that consent in an employer-employee relationship is almost never valid because of the power imbalance. Exceptions: genuinely optional perks with no consequence whatsoever for refusal (and even then, the burden of proof is high).