Category: Consent Requirements

Indication of Wishes

Also known as: Indication of the Data Subject's Wishes

Simply put

An indication of wishes is the way a person shows that they agree to their personal data being used, and it forms part of what makes consent valid under data protection law. This can be an action or a statement, but it must clearly signal that the individual is agreeing, rather than being assumed from silence or inaction. It is one of the key elements that consent must meet to count as a proper legal basis for processing.

Formal definition

Within the GDPR definition of consent, the "indication of the data subject's wishes" is the operative act by which a data subject signifies agreement to the processing of their personal data. Article 4(11) provides that consent must be a "freely given, specific, informed and unambiguous indication of the data subject's wishes" given by a statement or by a clear affirmative action; the indication is therefore the manifestation component that must satisfy those four qualifying conditions. The requirement that the indication be unambiguous generally excludes reliance on silence, pre-ticked boxes, or inactivity, and the concept was carried forward from the earlier EU Data Protection Directive, which described consent as an indication of wishes by which the data subject signifies agreement. Note that this term specifically concerns the consent basis under Article 6(1)(a); where special category data is processed, an additional condition under Article 9 is generally required, and practitioners should verify the current official text and applicable regulator guidance (including any divergence between the EU GDPR and UK GDPR) as the boundary of this definition is limited to the consent element and does not itself establish whether consent is the appropriate lawful basis.

Why it matters

The indication of wishes is the point at which consent becomes real rather than assumed. Under Article 4(11) GDPR, consent must be a "freely given, specific, informed and unambiguous indication of the data subject's wishes" expressed through a statement or a clear affirmative action. If the indication is missing or ambiguous, the consent is not valid, and any processing that relies on it generally lacks a lawful basis. For organisations, this means the mechanics of how agreement is captured are not a cosmetic detail but a determinant of whether the processing is lawful in the first place.

The unambiguity requirement is where many consent practices fail. Regulator guidance, including from the ICO, indicates that silence, pre-ticked boxes, and inactivity generally do not constitute a valid indication of wishes, because they do not clearly signal that the individual has actually agreed. The concept was carried forward from the earlier EU Data Protection Directive, which described consent as an indication of wishes by which the data subject signifies agreement, so the underlying principle predates the GDPR but is now applied more strictly.

It is important to keep the boundary of this concept in mind. The indication of wishes concerns the consent basis under Article 6(1)(a); it does not by itself establish that consent is the appropriate lawful basis for a given activity, since there are other Article 6 bases that may apply. Where special category data is processed, an additional condition under Article 9 is generally required. Practitioners should verify the current official text and applicable regulator guidance, and be aware that the position may diverge between the EU GDPR and the UK GDPR.

Who it's relevant to

Data Protection Officers and Compliance Leads

DPOs and compliance leads need to assess whether the way agreement is captured meets the Article 4(11) standard of an unambiguous indication of wishes. This informs consent record-keeping, review of opt-in mechanisms, and decisions about whether consent is even the right lawful basis versus another Article 6 basis. Where special category data is processed, they should also confirm that an additional Article 9 condition is satisfied.

Privacy and Data Protection Lawyers

Lawyers advising on consent must distinguish a valid indication of wishes from mechanisms that generally fail the unambiguity requirement, such as silence, pre-ticked boxes, or inactivity. They should also account for the continuity of the concept from the earlier Directive to the GDPR, and for potential divergence between the EU GDPR and UK GDPR, verifying positions against the current official text and applicable regulator guidance.

Product Managers and Engineers

Those building consent flows and user interfaces translate the legal requirement into design. Because the indication must be a statement or clear affirmative action, interfaces should require a deliberate positive step and avoid defaults that assume agreement. Design choices such as unchecked boxes and clear consent prompts directly affect whether the resulting indication of wishes is valid.

Marketing and Customer Data Teams

Teams that collect data for marketing or profiling often rely on consent, making the quality of the indication of wishes central to lawful processing. They should ensure sign-up and preference mechanisms capture a genuine affirmative action rather than inferring agreement, and coordinate with compliance to confirm whether consent or another lawful basis applies.

Inside Indication of Wishes

Affirmative Element

Under the GDPR definition of consent (Article 4(11)), an indication of the data subject's wishes must be expressed through a clear affirmative action or statement. A passive state, silence, or default setting does not generally amount to an indication of wishes.

Freely Given

The indication must reflect a genuine choice. Where there is an imbalance of power, bundled conditions, or detriment for refusal, the indication of wishes may not be considered freely given and the resulting consent may be invalid.

Specific and Informed

The wish must relate to defined processing purposes and be made against the background of adequate information about who is processing the data and why. A generalised or blanket indication typically will not satisfy the requirement for specificity.

Unambiguous

The indication must leave no reasonable doubt as to the data subject's intention. This generally requires a positive act (for example, ticking an unchecked box or an equivalent statement) rather than an inference drawn from inaction.

Attribution to the Data Subject

The indication of wishes must be that of the identified or identifiable individual whose personal data is being processed. It concerns the wishes of living individuals and is not generally relevant to anonymous data or, in most cases, deceased persons, subject to member state derogations.

Contextual Assessment

Whether a given action or statement amounts to a valid indication of wishes is assessed in context, taking account of the interface, the information presented, and the surrounding circumstances rather than treating any single mechanism as automatically sufficient.

Common questions

Answers to the questions practitioners most commonly ask about Indication of Wishes.

Does silence or a pre-ticked box count as an indication of wishes for consent purposes?

Generally, no. An indication of wishes for valid consent typically requires an affirmative, unambiguous act. Silence, inactivity, or pre-ticked boxes are not usually regarded as a clear indication of wishes, because they do not demonstrate an active choice by the data subject. The precise assessment depends on the context and applicable regulatory guidance, so verify against the current official text and relevant guidance.

Is an indication of wishes always required before personal data can be processed?

No. An indication of wishes is central to consent as a legal basis, but consent is only one of the distinct Article 6 legal bases. Processing may instead rely on, for example, contract, legal obligation, vital interests, public task, or legitimate interests, none of which depend on an indication of the data subject's wishes. Where consent is relied upon, the indication of wishes must meet the applicable standard, and special category data under Article 9 requires an additional condition.

How can an indication of wishes be captured in a web form or interface?

In most cases, it is captured through a clear affirmative action taken by the data subject, such as actively selecting an unticked option or otherwise signalling a deliberate choice. The interface should typically make the choice genuine and distinguishable from other actions, and the design should support a record of what the person indicated. The specific approach should be assessed against the applicable standard and current regulatory guidance.

What records should be kept to demonstrate a data subject's indication of wishes?

Where consent is the basis, an organisation should generally be able to evidence that an indication of wishes occurred, typically including what the person was told and the action they took to signal their choice. The level of detail appropriate is context and risk dependent, and practices can vary; confirm the demonstrability expectations against the applicable guidance and any national implementing requirements.

How should an indication of wishes be handled if the data subject wants to withdraw it?

Where the indication supported consent, it should generally be as straightforward to signal a change of position as it was to give the original indication. Implementers typically provide an accessible mechanism to reflect a new indication of wishes and ensure downstream processing responds accordingly. The exact operational requirements should be assessed in context and checked against the current official text and guidance.

Can one indication of wishes cover multiple, separate processing purposes?

This should be approached with caution. Where distinct purposes are involved, a single blanket indication may not clearly demonstrate the data subject's wishes for each purpose, and separate indications are often more defensible. Whether a combined indication is adequate is subject to assessment and can depend on the purposes involved and applicable guidance, so verify the position for the specific use case.

Common misconceptions

Any action by a user, including continuing to use a service or ignoring a notice, counts as an indication of wishes.

Silence, inactivity, and pre-ticked boxes do not generally constitute a valid indication of wishes under the GDPR definition of consent, which requires a clear affirmative act. The precise treatment of specific interface patterns can be subject to regulator guidance and may vary, so practitioners should verify against current official sources.

An indication of wishes is required for all lawful processing.

Consent, of which an indication of wishes is a core element, is only one of the Article 6 legal bases. Processing may instead rely on contract, legal obligation, vital interests, public task, or legitimate interests, and special category data under Article 9 requires an additional condition. An indication of wishes is not a universal requirement.

Once an indication of wishes is given, it settles the matter permanently.

An indication of wishes reflects the data subject's intention at a point in time and, where it forms the basis of consent, can generally be withdrawn. It should not be treated as a fixed or irrevocable position.

Best practices

Design consent mechanisms so that the indication of wishes is captured through a clear affirmative action, avoiding pre-ticked boxes, defaults, or reliance on silence or continued use.

Present specific, purpose-level information before the indication is sought, so that the wish can be treated as both specific and informed.

Assess whether the indication is freely given by checking for imbalance of power, bundling, or detriment for refusal, and document that assessment.

Retain records evidencing how and when the indication of wishes was obtained, so that its validity can be demonstrated if challenged.

Confirm that consent is the appropriate legal basis before relying on an indication of wishes, and identify an additional Article 9 condition where special category data is involved.

Where practices depend on evolving regulator guidance on specific interface patterns, verify the current position against official sources rather than treating a past interpretation as settled.