# GDPR consent: Definition and How It Works Source: https://wraps.dev/glossary/gdpr-consent ComplianceGDPR marketing consentlawful basis for email GDPR requires a lawful basis for processing personal data, and for marketing email that basis is generally consent — freely given, specific, informed, and an affirmative opt-in, not a pre-checked box or a default-in setting. ## What "affirmative" rules out A pre-ticked checkbox, an opt-out framed as the default with opt-in requiring extra effort, or consent bundled into agreeing to unrelated terms of service all fail GDPR's bar. Valid consent requires a clear, affirmative action specifically for the marketing communication in question — the recipient has to actually do something that unambiguously means yes, not merely fail to say no. ## It has to be specific, not blanket Consent to receive a transactional receipt is not consent to receive a marketing newsletter, and consent given for one company doesn't transfer to an affiliated company by default. Each distinct purpose generally needs its own clear consent, which is why a single "I agree" checkbox covering several different uses of an email address is a common compliance gap rather than an efficient shortcut. ## Consent has to be as easy to withdraw as it was to give GDPR requires that withdrawing consent be genuinely as simple as giving it — burying an unsubscribe mechanism behind a multi-step process, a required login, or a customer-support request when signup only took one click is itself a compliance failure, independent of whether the original consent was valid. ## This is a stricter bar than CAN-SPAM's, by design CAN-SPAM permits sending the first message without consent and requires honoring an opt-out afterward. GDPR requires the opposite ordering: consent before the first message, generally obtained through something functionally equivalent to double opt-in for it to hold up. A sender that treats CAN-SPAM compliance as sufficient for an EU audience is applying the wrong bar to that segment of the list. Consent isn't the only lawful basis GDPR recognizes, either — legitimate interest is a narrower alternative sometimes invoked for B2B email to an existing business contact, but it requires its own documented balancing test against the recipient's rights and still has to honor an opt-out, so it's a higher-effort exception rather than a way around consent generally. ## Consent records need to be kept, not just obtained GDPR's accountability principle expects a controller to be able to demonstrate, later, that valid consent was actually given — what was agreed to, when, and through what mechanism. A signup flow that captures the confirmation click but discards the timestamp and the exact wording shown at the time has weakened its own evidence, even if the consent itself was originally valid. ## Why it matters GDPR's consent requirement is the reason double opt-in isn't just a deliverability best practice for a list with EU subscribers — it's close to the practical minimum needed to demonstrate the kind of freely given, specific, affirmative consent the regulation actually requires, and a single-opt-in EU signup flow is a real, documented compliance gap, not a stylistic choice. ## Common questions ### Does a pre-checked consent checkbox satisfy GDPR? No. GDPR requires an affirmative action specifically for that purpose — a pre-ticked box, an opt-out framed as default, or consent bundled with unrelated terms all fail the bar, regardless of how clearly the checkbox's label described what it was for. ### Can one consent checkbox cover both transactional and marketing email? Generally no. GDPR expects specific consent per distinct purpose, so a marketing newsletter typically needs its own clear consent separate from whatever basis covers transactional messages like receipts or password resets. ### Is CAN-SPAM compliance enough for emailing EU recipients? No. CAN-SPAM permits sending without prior consent and requires honoring opt-outs afterward; GDPR requires consent before the first message. A sending list with EU recipients has to meet GDPR's stricter, consent-first bar for that segment specifically.