Skip to main content
Privacy Track
Category: Consent Requirements

Statement or Clear Affirmative Action

Also known as: Clear Affirmative Action, Clear Affirmative Act
Simply put

This is the requirement that someone must actively and deliberately do something to agree to their personal data being used, rather than agreement being assumed from silence or inaction. For example, a person might make a clear statement or take a specific step to opt in. Pre-ticked boxes or simply not objecting generally do not meet this standard.

Formal definition

"Statement or clear affirmative action" is the standard by which consent under the GDPR must be given, ensuring it is unambiguous. It requires a deliberate and specific act by the data subject to signify agreement to the processing of their personal data, meaning consent cannot be inferred from silence, pre-ticked boxes, or inactivity. Per ICO guidance, the action must be deliberate and specific to opt in or agree, even where not framed explicitly as an opt-in. This requirement sits within the definition of valid consent and should be read alongside the other conditions for consent (for example that it be freely given, specific, and informed); practitioners should verify the precise conditions and any special category requirements against the current official text of the Regulation and applicable regulator guidance.

Why it matters

The requirement for a statement or clear affirmative action is central to whether consent can be relied upon as a lawful basis for processing under the GDPR. Because consent must be unambiguous, agreement cannot be implied from silence, inactivity, or pre-ticked boxes. If an organisation cannot demonstrate that the data subject took a deliberate and specific step to opt in, the consent is likely to be invalid, and any processing that depends on it may lack a lawful basis. This affects everything from marketing sign-ups to cookie banners and app permission flows.

Getting this wrong tends to have knock-on effects across a compliance programme. Where consent is the chosen basis but the affirmative-action standard is not met, controllers may face challenges not only to the lawfulness of the processing but also to related obligations such as accountability and the ability to evidence that consent was properly obtained. It is worth noting that consent is only one of several Article 6 legal bases, and the affirmative-action standard applies specifically when consent is relied upon rather than as a universal requirement for all processing.

The term should not be confused with the unrelated concept of 'affirmative action' in the employment and anti-discrimination context, which appears in some general sources but has no bearing on GDPR consent. Practitioners should treat the two as entirely distinct and verify the precise conditions for valid consent against the current Regulation text and applicable regulator guidance, since special category data under Article 9 requires an additional condition beyond a valid consent mechanism.

Who it's relevant to

Data Protection Officers and Compliance Leads
DPOs and compliance teams need to assess whether consent mechanisms across the organisation meet the clear affirmative action standard, and whether consent is even the appropriate legal basis in the first place. This includes reviewing sign-up flows, cookie management tools, and consent records to confirm that agreement is captured through a deliberate, specific act rather than inferred from inaction.
Engineers and Product Teams
Those building interfaces and consent flows should ensure that opt-in mechanisms require a positive step, avoiding pre-ticked boxes or default-on settings where consent is the chosen basis. The design should make the affirmative action clear and specific to the processing described, and should be capable of generating records that demonstrate how and when agreement was given.
Privacy Lawyers and Advisers
Lawyers advising on consent should distinguish this requirement from the other conditions for valid consent and confirm whether consent, rather than another Article 6 basis, is appropriate. They should also note that special category data under Article 9 requires an additional condition, and should verify the precise standard against the current official text and applicable regulator guidance, given that positions can vary by jurisdiction and evolve over time.
Marketing and CRM Teams
Teams managing subscriber lists and direct engagement rely on validly obtained consent where consent is the basis for contact. They should ensure that individuals are added only after taking a clear affirmative action to opt in, since agreement assumed from silence or inaction generally will not support lawful processing.

Inside Statement or Clear Affirmative Action

Statement
An express indication of agreement, such as a written or oral declaration, that signals the data subject's wish to consent. Under the GDPR, valid consent under Article 4(11) requires an unambiguous indication of the data subject's wishes.
Clear Affirmative Action
A positive act by the data subject that plainly signifies agreement to the processing of their personal data. This is the alternative to a statement and is intended to require an active, deliberate step rather than passivity.
Unambiguous indication
The overarching requirement that the statement or action leaves no reasonable doubt that the data subject intended to consent. This links the concept to the Article 4(11) definition of consent, which also requires that consent be freely given, specific, and informed.
Exclusion of inaction and default settings
Pre-ticked boxes, silence, or inactivity generally do not meet the standard, as clarified in regulatory guidance and case law. The absence of an act is typically not treated as a clear affirmative action.
Contextual demonstrability
The controller must generally be able to demonstrate that the statement or affirmative action occurred, consistent with the accountability principle and the controller's obligation to show consent was obtained where consent is the relied-upon Article 6 basis.

Common questions

Answers to the questions practitioners most commonly ask about Statement or Clear Affirmative Action.

Does silence or a pre-ticked box count as a statement or clear affirmative action?
No. Silence, inactivity, and pre-ticked boxes do not constitute a statement or clear affirmative action. The concept requires a positive, deliberate act by the data subject that unambiguously signifies agreement. A failure to opt out, or reliance on a default that the individual has not actively engaged with, generally falls short of this standard. This position is reflected in the GDPR's recitals and in guidance from data protection authorities; you should verify the precise wording against the current official text.
Is a clear affirmative action the same thing as consent being valid overall?
Not by itself. A clear affirmative action is only one component of valid consent. Consent must also be freely given, specific, and informed, and the individual must be able to withdraw it as easily as it was given. A perfectly executed affirmative act does not cure defects elsewhere, for example where there is an imbalance of power, bundled purposes, or inadequate information. The affirmative action requirement addresses how agreement is expressed, not whether all other conditions for valid consent are met.
What kinds of user interactions can qualify as a clear affirmative action in practice?
In most cases, actions such as ticking an unchecked box, actively selecting settings, or otherwise taking a deliberate step that a reasonable person would understand as signalling agreement can qualify, provided the surrounding context is clear. The key is that the act must be unambiguous and specific to the processing in question. Whether a particular interaction meets the threshold is context-dependent and subject to assessment, and some regulators may take stricter views on particular interface patterns.
How should we handle consent where several distinct processing purposes are involved?
Generally, agreement should be sought in a way that allows the individual to signify consent separately for each distinct purpose, rather than through a single blanket action covering unrelated purposes. Bundling purposes into one affirmative act can undermine the specific and informed elements of consent. Practically, this typically points toward granular options so each affirmative action maps to a defined purpose. Assess your particular configuration against current regulatory guidance, as expectations on granularity can vary.
What records should we keep to show that a clear affirmative action occurred?
As a matter of accountability, it is generally advisable to retain evidence of how and when the affirmative action took place, what the individual was told at the time, and the specific version of the interface or wording presented. This helps demonstrate that agreement was a deliberate act rather than inferred from inactivity. The precise records that are sufficient are context-dependent, and you should align retention of consent evidence with your broader documentation and data minimisation obligations.
Can a default setting that the user leaves unchanged ever serve as an affirmative action?
Typically not, where the user has simply not altered a default. The requirement centres on a positive act, so relying on an untouched default generally does not meet the threshold, and pre-selected options in particular are problematic. Where a design depends on defaults, it is prudent to reassess whether the individual is genuinely taking a deliberate step. Because interface-based consent mechanisms are an area of continuing regulatory attention, treat borderline patterns as subject to assessment rather than settled.

Common misconceptions

Continuing to use a website or leaving a pre-ticked box unchanged counts as a clear affirmative action.
Regulatory guidance and case law indicate that inactivity, silence, and pre-ticked boxes generally do not constitute a clear affirmative action, because they do not reliably demonstrate an active, deliberate expression of the data subject's wishes. Whether a given interface meets the standard is subject to assessment.
A statement or clear affirmative action is, on its own, enough to make consent valid.
The statement or affirmative action addresses the 'unambiguous indication' element, but valid consent under Article 4(11) must also be freely given, specific, and informed. In addition, consent is only one of the Article 6 legal bases, and special category data under Article 9 requires a separate additional condition.
Consent (via a statement or affirmative action) is always required to process personal data.
Consent is one of several distinct Article 6 legal bases; contract, legal obligation, vital interests, public task, and legitimate interests may apply instead. Relying on a statement or clear affirmative action is only relevant where consent is genuinely the appropriate basis.

Best practices

Design consent mechanisms that require a genuine positive act, such as an unticked box the data subject must select, rather than relying on default settings, silence, or continued use.
Keep records that allow you to demonstrate when and how the statement or clear affirmative action occurred, in line with the accountability principle.
Before defaulting to consent, assess whether another Article 6 basis is more appropriate, and document that analysis.
Where special category data is involved, identify and record the separate Article 9 condition in addition to satisfying the affirmative action requirement.
Ensure that the surrounding information is clear so that the affirmative action is also informed and specific, not just an isolated click.
Review interfaces against current regulatory guidance, and revisit them when guidance evolves, since the boundary of what qualifies can be refined over time and may vary between regulators.