Category: Consent Requirements

Consent Not Freely Given

Also known as: Invalid Consent (freely given element), Consent Lacking Free Choice

Simply put

Consent is one of the ways an organisation can be allowed to use someone's personal data, but it only counts if the person had a real, unpressured choice to say yes or no. Consent is treated as 'not freely given' when the individual has no genuine choice, cannot refuse, or cannot withdraw their agreement without suffering some disadvantage. In such cases the consent is generally not valid, and the organisation typically cannot rely on it to justify the processing.

Formal definition

"Consent not freely given" describes a failure of one of the cumulative requirements for valid consent under the GDPR framework, where consent must be freely given, specific, informed and unambiguous. According to ICO guidance, consent should not be regarded as freely given where the data subject has no genuine or free choice, or is unable to refuse or withdraw consent without detriment. Recital 43 indicates consent is presumed not to be freely given where a controller does not permit separate consent for distinct processing operations, and imbalances of power or conditionality (for example, tying consent to the performance of a service that does not require the processing) are commonly cited factors weighing against free choice, though such assessments are fact-specific. Where the free-choice element fails, the consent is generally invalid as an Article 6 lawful basis, and a controller may need to consider whether another lawful basis applies; special category data would additionally require a separate condition. This definition addresses only the 'freely given' element and does not cover the specific, informed, or unambiguous requirements, and practitioners should verify the precise conditions and any national or UK GDPR variations against the current official text and applicable regulatory guidance.

Why it matters

Consent is only one of several lawful bases available under Article 6 of the GDPR, but it is often the most fragile because it depends entirely on the quality of the individual's choice. When consent is not freely given, it is generally invalid, which means the processing it was meant to justify may have no lawful basis at all. An organisation that has relied on consent and later finds that consent was not freely given typically faces a gap: it must either identify an alternative lawful basis that genuinely applies or stop the processing. For special category data under Article 9, a separate condition would also be required, so the exposure can be compounded.

The 'freely given' element is particularly sensitive to power imbalances and conditionality. ICO guidance indicates that consent should not be regarded as freely given where the data subject has no genuine or free choice, or is unable to refuse or withdraw consent without detriment. Recital 43 goes further by treating consent as presumed not freely given where a controller does not permit separate consent for distinct processing operations, or where consent is bundled or tied to a service in a way that removes real choice. Because these assessments are fact-specific, the same design pattern may pass or fail depending on context, so organisations cannot assume that a consent mechanism that worked in one setting will be valid in another.

The practical stakes are high because consent-based processing that later collapses can undermine an entire product feature, marketing programme, or data-sharing arrangement retrospectively. Practitioners should note that regulatory interpretation and national or UK GDPR variations can affect where the boundary lies, and the precise conditions should be verified against the current official text and applicable guidance rather than treated as settled.

Who it's relevant to

Data Protection Officers and Compliance Leads

DPOs and compliance leads assessing whether consent can be relied upon should scrutinise the freely given element, particularly where there is a power imbalance or where consent is bundled or conditional. They should be prepared to identify an alternative lawful basis, and any additional Article 9 condition for special category data, if the consent is found to be invalid.

Product Designers and Engineers

Those building consent flows and preference interfaces should design mechanisms that allow separate consent for distinct processing operations, as bundling can lead to consent being presumed not freely given under Recital 43. They should also ensure individuals can refuse or withdraw consent without detriment, since the ease and consequence of withdrawal directly bear on validity.

Marketing and Digital Teams

Teams relying on consent for direct marketing or analytics should avoid tying consent to a service in a way that removes genuine choice, and should be cautious about incentives or conditions that could be argued to compromise voluntariness. Because these assessments are fact-specific, the acceptability of a given approach should be reviewed with legal or DPO input.

Privacy and Data Protection Lawyers

Advisers evaluating consent-based processing should analyse the freely given element in context, including conditionality, imbalance of power, and the ability to withdraw without detriment. They should note that interpretation can diverge across regulators and that national or UK GDPR variations may affect the position, verifying against current official text and guidance.

Inside Consent Not Freely Given

Imbalance of Power

A key indicator that consent is not freely given, typically arising where there is a clear asymmetry between the controller and the data subject. Recital 43 of the GDPR flags this concern particularly in relation to public authorities, and it is also frequently discussed by regulators in the employment context, where an employee may feel unable to refuse an employer's request without adverse consequences.

Conditionality (Bundling)

Under Article 7(4), when assessing whether consent is freely given, utmost account must be taken of whether the performance of a contract is made conditional on consent to processing that is not necessary for that contract. Bundling non-necessary processing into a service is generally viewed as undermining the free nature of consent, though the position is subject to case-by-case assessment.

Absence of Genuine Choice

Consent is generally not freely given where the data subject has no real or free choice, or is unable to refuse or withdraw without detriment. Recital 42 states that consent should not be regarded as freely given where the data subject has no genuine or free choice.

Detriment for Refusal or Withdrawal

Where declining or later withdrawing consent leads to negative consequences for the individual, the voluntariness of the consent is undermined. Article 7(3) requires that withdrawing consent be as easy as giving it, and a withdrawal mechanism that carries penalties can call the freely given standard into question.

Relationship to the Broader Valid Consent Standard

Freely given is one of four cumulative requirements for valid consent under Article 4(11), alongside specific, informed, and unambiguous. A failure on the freely given element means consent cannot be relied upon as a lawful basis under Article 6(1)(a), regardless of whether the other elements are met.

Common questions

Answers to the questions practitioners most commonly ask about Consent Not Freely Given.

Is ticking a consent box always enough to make consent valid?

No. A tick or click captures an action, but it does not by itself establish that consent was freely given. If the individual had no genuine choice, faced detriment for refusing, or could not decline without losing access to an unrelated service, the consent may not be valid regardless of how it was recorded. The mechanism of capture and the validity of consent are distinct questions, and both must be satisfied.

If someone can withdraw consent later, does that mean the original consent was freely given?

Not necessarily. The right to withdraw consent, and the requirement that withdrawal be as easy as giving it, is a separate condition from whether consent was freely given at the outset. Consent obtained under pressure, conditionality, or a clear imbalance of power can be invalid from the start even if a withdrawal option exists. A functioning withdrawal mechanism does not cure a defect in how consent was originally sought.

How should an organisation approach consent where there is an imbalance of power, such as between an employer and employee?

Where there is a clear imbalance of power, regulators and guidance have generally treated consent as unlikely to be freely given, because the individual may fear adverse consequences from refusing. In such contexts, organisations should typically assess whether another Article 6 legal basis is more appropriate rather than relying on consent. Any reliance on consent in these settings should be supported by a documented assessment showing genuine, consequence-free choice, and readers should verify the position against current regulator guidance, which can vary.

Can access to a service be made conditional on consenting to processing that is not necessary for that service?

Generally this is problematic. Where consent to non-necessary processing is bundled with, or made a condition of, providing a service, the freely given element is called into question. Organisations should typically separate necessary processing from optional processing, and avoid making the core service contingent on consent that the individual does not need to give to receive it. Whether a particular bundling arrangement is acceptable is subject to assessment of the specific facts.

What should an organisation do if it concludes its consent was not freely given?

If an organisation determines that consent relied upon was not freely given, that consent should generally be treated as an unreliable basis for the processing concerned. The organisation should assess whether a different Article 6 basis applies, and if none does and the consent cannot be validly re-obtained, it should consider whether the processing must stop and whether remediation is needed. This is a context-dependent judgement and specialist advice may be appropriate.

How can an organisation demonstrate that consent was freely given?

Demonstrating freely given consent typically involves keeping records of what the individual was told, how the choice was presented, and evidence that refusal carried no detriment and was not a condition of an unrelated service. Documenting the absence of bundling, the availability of a genuine option to decline, and any assessment of power imbalance can support accountability. The adequacy of such records is judged in context, and organisations should align their approach with current regulator guidance.

Common misconceptions

Any ticked box or clicked 'I agree' constitutes valid, freely given consent.

A mechanism to record agreement does not by itself establish that consent was freely given. If the choice is illusory, bundled with unnecessary processing, or extracted under an imbalance of power, the consent may be invalid despite the presence of an affirmative action. Each situation requires assessment against the relevant indicators.

Consent is always the appropriate legal basis, so obtaining it is the safe default.

Consent is one of several distinct Article 6 legal bases and is not universally required. Where genuine free choice cannot be offered, for example in certain employment or public authority contexts, relying on consent may be inappropriate, and another lawful basis may be more suitable. Choosing consent where it cannot be freely given can leave the processing without a valid basis.

As long as a service provider offers the sign-up, making it conditional on consent to extra processing is fine.

Article 7(4) requires utmost account to be taken of whether contract performance is made conditional on consent to processing not necessary for that contract. Bundling non-necessary processing into access to a service is generally treated as a strong indicator that consent is not freely given, subject to assessment of the specific circumstances.

Best practices

Assess whether a genuine, free choice exists before relying on consent, paying particular attention to imbalance-of-power contexts such as employment and interactions with public authorities.

Avoid bundling: separate consent for processing that is not necessary to deliver the requested service from the contract itself, consistent with Article 7(4).

Ensure that refusing or withdrawing consent does not expose the data subject to detriment, and make withdrawal as easy as giving consent per Article 7(3).

Where free choice cannot realistically be offered, evaluate whether an alternative Article 6 legal basis is more appropriate rather than defaulting to consent.

For special category data, remember that a valid Article 9 condition is required in addition to an Article 6 basis, and confirm the consent still meets the freely given standard.

Document the assessment of the freely given element and verify specific wording, article references, and any regulator guidance against the current official text, as interpretation can vary between supervisory authorities.