The question at hand
You're launching a new marketing campaign. Your legal team asks: what's your lawful basis? The answer often comes back reflexively: consent. It's become the default choice for many organizations when processing personal data. But should it be?
The consent model under GDPR has created a fundamental tension. On one side, practitioners argue that consent offers a clear path to compliance, giving data subjects explicit control and minimizing regulatory risk. On the other, a growing number of privacy officers contend that over-reliance on consent creates operational fragility and often serves neither the organization nor the data subject well.
This isn't an academic debate. Your choice of lawful basis shapes everything from your technical architecture to your user experience to your exposure when a supervisory authority comes knocking.
The case for consent as default
The consent-first approach has genuine appeal, especially for teams burned by enforcement actions or operating in high-scrutiny sectors.
Regulatory clarity. Article 7 sets out specific conditions for valid consent. You know what you're building toward: freely given, specific, informed, and unambiguous. When a supervisory authority questions your processing, you can point to an affirmative action, a clear request, and documented acceptance. There's no legitimate interests assessment to defend, no compatibility assessment to justify.
User expectations align. Data subjects increasingly expect to be asked. Cookie banners, marketing preferences, and account creation flows have normalized the consent interaction. Your users understand "yes" and "no" in a way they don't understand legitimate interests assessments or contractual necessity arguments.
Withdrawal is built-in. Article 7(3) requires that withdrawing consent be as easy as giving it. This creates a clean exit mechanism. When someone opts out, you stop processing. No complex retention schedules, no arguments about whether you can continue under a different lawful basis. The relationship is transactional and reversible.
Audit trail simplicity. Consent creates verifiable records. You can show exactly when someone agreed, to what, and through which interface. When you're facing a DSAR or supervisory authority inquiry, timestamped consent records are straightforward evidence.
For marketing teams especially, consent feels like the safe harbor. You're not making legal arguments about balancing tests or trying to fit promotional emails into "contractual necessity." You asked, they said yes, you have proof.
The case against consent as default
But consent's apparent simplicity creates hidden costs that many organizations only discover after they've built their entire data strategy around it.
Consent is fragile by design. The same Article 7(3) that gives data subjects easy withdrawal means your lawful basis can evaporate at any moment. When 30% of your users withdraw consent after a privacy scandal in your sector, you don't just lose the ability to send marketing emails. You lose the foundation for processing that data entirely. Your analytics break. Your personalization engine stops. Your retention schedules become legally questionable.
It's often the wrong tool. Consider fraud prevention. You could ask for consent to process data for security monitoring, but Article 7(4) makes clear that consent isn't freely given when it's a condition of service. You're better off with legitimate interests, properly assessed and documented. Same for most operational processing: customer support ticket resolution, payment processing, account security. Consent adds friction without adding legal strength.
The user experience is degrading. We've created consent fatigue. Your carefully crafted consent request is the fifteenth modal dialogue someone has seen today. They're clicking "Accept All" without reading because they've learned that's the price of entry. You're collecting consent that meets the letter of Article 7 but violates its spirit. The EDPB's guidelines on valid consent make clear that bundled consent or consent walls often fail the "freely given" test.
Technology hasn't solved the core problem. Consent management platforms can track preferences across dozens of purposes and jurisdictions, but they can't fix the fundamental issue: you're asking users to make legal determinations about data processing they don't understand and can't meaningfully evaluate. "We process your data for service improvement and personalization" sounds reasonable until someone asks what that actually means for their profile data.
Where practitioners actually land
In practice, most mature privacy programs use consent selectively, not universally.
You'll see consent for truly optional processing: newsletters, marketing communications, non-essential cookies. Things where withdrawal doesn't break the core service and where user choice is genuine.
For everything else, they're doing the harder work: legitimate interests assessments for analytics, contractual necessity for order fulfillment, legal obligation for tax records. They're building systems that don't collapse when someone opts out, because the critical processing never relied on consent in the first place.
The organizations that struggle are often those that built consent-first architectures and are now trying to retrofit other lawful bases without breaking existing data flows. They've got consent records for processing that should never have required consent, and gaps in documentation for processing that genuinely does.
Our take
Consent shouldn't be your default. It should be your choice for specific processing where user control is both meaningful and operationally sustainable.
Before you reach for consent, ask: Can I justify this processing under legitimate interests? Is it necessary for contract performance? If those answers are yes, document that basis properly rather than defaulting to consent because it feels safer.
When you do use consent, build systems that respect its fragility. That means separating critical processing (which shouldn't rely on consent) from optional processing (which can). It means making withdrawal genuinely easy and building data flows that don't break when someone opts out. It means consent requests that are specific enough to be meaningful, not vague buckets that let you process however you want.
The call for solutions to improve the consent model is valid. But the solution isn't better consent technology or more sophisticated preference centers. It's using consent where it belongs and having the courage to use other lawful bases, properly documented and assessed, for everything else. Your users will thank you for not asking them to make decisions they can't meaningfully evaluate. Your supervisory authority will thank you for processing data on solid legal grounds that don't evaporate with a single click.
