Module 4 · Consent - the four conditions and children
Valid consent must be freely given, specific, informed and unambiguous - a clear affirmative act, clearly distinguishable and in plain language, with records kept. Silence, pre-ticked boxes and inactivity do NOT qualify. For offered to children relying on consent, verifiable parental consent is required below age 16 (Member States may lower to no younger than 13).
| Condition | What it means |
|---|---|
| Freely given | Genuine choice; withdraw as easily as give; avoid where there is a clear imbalance (public authority; employer–employee) |
| Specific | Informed of all intended purposes at the time; new purposes may need fresh consent (some flexibility for scientific research) |
| Informed | At least the controller's identity, the purpose, and how processing may affect the data subject; plain language; controller must demonstrate it |
| Unambiguous | A positive, affirmative opt-in. Silence, pre-ticked boxes and inactivity do NOT qualify |
Where there is a clear imbalance - a public authority over a citizen, or an employer over an employee - consent is rarely "freely given." For goods/services, look first to contractual necessity unless consent is genuinely necessary.
Children (Article 8): where an information society service is offered to a child and relies on consent, verifiable parental/guardian consent is required below age 16 (Member States may lower the threshold to no younger than 13).
Article 8 digital-consent age: 16 (floor of 13). In the EU, "child" for other purposes/automated processing means under 18. The US COPPA sets the parental-consent age at 13.