# GDPR Article 7 — Conditions for consent > What it means to "have consent" under the GDPR — burden of proof, plain language, the right to withdraw, and freely-given conditions. Citation: *Regulation (EU) 2016/679* Last reconciled with canonical source: 2026-04-25 Canonical: https://eur-lex.europa.eu/eli/reg/2016/679/oj Source: https://consenttheater.org/law/gdpr/art-7/ --- ## In plain language Article 6(1)(a) says you can process personal data if the user consents. Article 7 says **what counts as consent**. The two are inseparable — a "yes" that doesn't satisfy Article 7 isn't legally a "yes". The four pillars of valid consent under Article 7: 1. **Demonstrable.** The controller must be able to prove the user consented. No log, no consent. 2. **Distinct, intelligible, plain language.** If consent is requested as part of a longer statement (terms of service, privacy notice), the consent ask must be presented in a way that is clearly distinguishable from the other matter and written in plain language. 3. **Withdrawable, and as easy to withdraw as to give.** The user must be informed of this before consenting, and the withdrawal flow can't be designed to be harder than the give flow. 4. **Freely given.** Conditioning a service on consent that isn't strictly necessary for that service is a strong signal the consent isn't free. So is a significant power imbalance (e.g., between an employer and an employee). In practice, the EDPB and most national authorities have interpreted these conditions to mean that **cookie banners with a prominent "Accept" button and a hidden, multi-click "Reject" path are not free consent**, and the consent they collect is invalid. **UK:** Article 7 of the [UK GDPR](/law/uk-gdpr-and-pecr/) is identical. The ICO has been particularly active on dark-pattern banners — its 2023–2024 statements explicitly target sites where Reject takes more clicks than Accept. ## How we use this on consenttheater.org - Our [classification process](/methodology/#process) explicitly checks how a tracker maps to Article 7's "freely given" and "as easy to withdraw as to give" conditions. - The browser extension's banner-quality observations (missing reject button, unequal button parity, dark patterns) are practical signals that Article 7 conditions are likely *not* met — even when a banner exists. ## Original text Reproduced verbatim from *Regulation (EU) 2016/679*, published by the Publications Office of the European Union on [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2016/679/oj). The official source is authoritative; this rendering is a navigation convenience. > **1.** Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data. > > **2.** If the data subject's consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language. Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding. > > **3.** The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent. > > **4.** When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Prefer the canonical version? [Open this article on eur-lex.europa.eu →](https://eur-lex.europa.eu/eli/reg/2016/679/oj) --- ## Reproduction notice The text reproduced on this page is taken from the consolidated version of *Regulation (EU) 2016/679*, an official act of the European Union. EU legislative texts are excluded from copyright protection (recital 22 of Directive (EU) 2019/790). ConsentTheater is not affiliated with, endorsed by, or sponsored by any EU institution. For binding legal use always consult the official source on [eur-lex.europa.eu](https://eur-lex.europa.eu/eli/reg/2016/679/oj). We re-verify each reproduction against the canonical text on the date shown at the top of this page.