Processing personal data is generally forbidden if it is not expressly allowed by law, or the impacted persons have not consented to processing these data. The consent of those whose personal data is collected, processed and/or used puts the persons in the position to be able to dispose of their personal rights.

The basic requirements for the effectiveness of valid legal consent are defined in Art. 7 of the GDPR and specified further in recital 32. This must be voluntarily granted for a concrete case after sufficient information is provided to the person involved and must be clearly communicated. The person involved must be given a true choice for the consent to be voluntary. In addition, a so-called “coupling prohibition” applies. Thus, a concluded contract may not be made dependent upon the consent to process further personal data which is not needed for completing a transaction. In addition, the consent must be bound to one or several specified purposes which are then sufficiently explained. Should the consent legitimise the processing of special personal data, it must expressly refer to this. The person impacted must, in all cases, be explained the ability to retract his consent. The retraction must be as easy to do as the granting of the consent itself.

There is no form requirement for the consent, even if a written consent is recommended due to the accountability of the persons responsible. It can therefore be executed in electronic form. One must consider, however, that recital 32 requires that a consent may only be granted through a clear negotiation. This includes the requirement for an opt-in. A special item in this regard is consent for children and adolescents in relation to information company services. There is an additional consent or agreement requirement from those with parental rights for those who are under the age of 16. The age limit is subject to an escape clause. Member States can reduce this in their national law to 13 years of age. Should the service offering not explicitly be directed to children, it is freed of this rule. This does not apply, however, to offers which are open to both children and adults.