Consent Under the GDPR: When 'Accept All' Doesn't Mean Consent

Consent is the central fiction of digital autonomy. The GDPR tried to fill it with substance, and dark patterns tried to hollow it back out.

The four conditions of valid consent

The GDPR (Regulation (EU) 2016/679) defines consent through four attributes: it must be freely given, specific, informed, and unambiguous (Recital 32) (GDPR-info). The absence of any one of them renders the consent legally void.

The "clear affirmative act"

Consent must be expressed through a clear affirmative act; silence, pre-ticked boxes, and inactivity do not constitute consent. Being "informed" means that a person is at least notified of the controller's identity and the purposes of processing — a safeguard against the gradual expansion of purposes (function creep).

Where "freely given" breaks down

In practice, cookie banners often break precisely the "freely given" requirement: a bright "Accept all" button set against a hidden "Reject," more steps to withdraw than to grant consent, a design that nudges the user toward the "convenient" answer. Formally there is a choice — in fact it is predetermined.

The EDPB guidelines

In Guidelines 03/2022, the European Data Protection Board (EDPB) showed how deceptive banner design violates the principle of fair processing (Article 5(1)(a) GDPR): unequal buttons, choice overload, and asymmetry of effort (EDPB).

Enforcement

National regulators are moving from principles to fines: France's CNIL expressly requires that refusing cookies be as easy as accepting them, and has imposed multimillion-euro fines for violations (CNIL).

Two circuits: GDPR and DSA

Manipulative consent sits at the intersection of two regimes: the GDPR requires its validity, while Article 25 of the DSA prohibits interfaces that distort choice. Together they outline a standard: consent must be a person's decision, not the product of a design engineered against them.