Consent management

What is consent management?

Consent management is how an organisation captures, stores, and honours the permission people give for their personal data to be processed. That covers the cookie banner on a website, the opt-in box on a signup form, the record of who agreed to what, and the machinery that stops processing the moment someone changes their mind.

The point is not the banner. The point is the record behind it. If a visitor accepts analytics cookies but refuses advertising ones, consent management is what makes sure the advertising tags actually stay switched off, and what lets you prove later that the choice was respected.

What valid consent means under the GDPR

Consent is one of the legal grounds for processing personal data under the GDPR. Article 4(11) defines it as any "freely given, specific, informed and unambiguous" indication of a person's wishes, given by a statement or a clear affirmative action. A pre-ticked box or plain silence does not count, because nothing was actively chosen.

Article 7 adds the conditions you have to meet. You must be able to demonstrate that the person consented, so keeping a record is not optional. The request has to be separate from other terms and written in plain language. Withdrawal has to be possible at any time, and it must be as easy to withdraw as it was to give. And consent is not "freely given" if you make a service conditional on data you do not actually need to deliver it.

Cookie consent has a second source on top of this: the EU ePrivacy Directive, often called the cookie law, requires consent before storing non-essential cookies on someone's device. The GDPR sets the bar for what a valid yes looks like, and the ePrivacy rules say when you have to ask.

How a consent setup works

Capture. A consent interface, usually a Consent Management Platform (CMP), presents the choices: which categories of tracking or processing, described in plain terms, with a real option to refuse.

Record. Every decision is stored with enough context to stand up later: who consented, to what, when, which version of the notice they saw, and how they signalled it. This is the evidence Article 7 asks for, and it feeds the wider audit trail.

Enforce. The stored choice has to drive real behaviour. Tags, scripts, and downstream systems read the consent state and only fire for the purposes that were allowed.

Withdraw. People can come back and change or revoke a choice, and the change has to propagate everywhere the original consent reached. A withdrawal that leaves the tracking running is worse than no banner at all.

In digital advertising, many CMPs also speak the IAB Europe Transparency and Consent Framework, a shared format for passing consent signals to ad vendors. It is one industry standard among several, not a legal requirement in itself.

Consent management versus data governance

Consent is one lawful basis, not the only one. Plenty of processing runs on contract, legal obligation, or legitimate interest instead, and forcing consent where another basis fits can create more risk, not less. Deciding which basis applies to which activity is a data governance question, and consent management is the part that operates the consent-based slice of it.

It also connects to data minimisation. The fewer purposes you process PII for, the fewer things you need to ask consent for, and the simpler the whole record becomes.

What to watch out for with consent management

Consent theatre. A banner that records a yes but keeps firing trackers regardless is not compliance, it is a paper trail of a promise you broke. Enforcement is the hard part, not the interface.

Dark patterns. Making "accept all" one click and "reject" a maze of menus undermines "freely given", and European regulators have issued fines over exactly this design.

Bundled consent. One checkbox covering analytics, advertising, and personalisation at once fails the specific test. Separate the purposes so each can be accepted or refused on its own.

Stale records. If you change what you collect or add a new purpose, old consent does not stretch to cover it. Ask again.

The withdrawal gap. Giving consent in one click and hiding withdrawal three screens deep breaks Article 7 directly. Make leaving as easy as joining.