GDPR · Regulation (EU) 2016/679
Article 7a
Compare the available Commission, Council and Parliament texts and amendments affecting this article.
Article total: 1 part · 0 Council drafts · 1 Parliament amendment
Removed wording is struck through; added or replacement wording is highlighted.
Institutional text
European Commission proposal
All Commission’s changes to GDPRThe wording proposed by the Commission at the start of this legislative file.
No standalone Commission wording is mapped to these tracked parts. A newly proposed provision may have no earlier text of its own.
Institutional text
Council Presidency texts
Successive Presidency compromise texts. Their inclusion does not imply agreement or adoption.
No Council wording is mapped to these tracked parts.
Competing proposals
European Parliament amendments
These are alternative tabled amendments. An amendment affecting several tracked parts appears once here, with each target identified.
More filters
Additional proposed wording Amendment 1017 · Julie Rechagneux, Mélanie Disdier, Aleksandar Nikolic, Pierre-Romain Thionnet, Alexandre Varaut, Fabrice Leggeri, Marion Maréchal, António Tânger Corrêa, Christophe Bay ITRE · LIBE
2g. The following Article 7a is inserted
Article 7a
Consent interfaces
Any interface used to request, give, refuse or withdraw consent under this Regulation, including for the storing of, or access to, information in terminal equipment, shall be fair, neutral, intelligible and easily accessible.
Consent shall be freely given, specific, informed and unambiguous. It shall be requested separately for each purpose and require a statement or clear affirmative action. Silence, inactivity, pre-ticked boxes or the mere continued use of a service shall not constitute consent. Fresh consent shall be required for any other purpose.
Consent shall not be freely given where the data subject has no genuine choice, cannot refuse or withdraw consent without detriment, including in the presence of a clear imbalance between the data subject and the controller, or where access to a service, its functionalities or an equivalent version thereof is made conditional on consent to processing, storing or access that is not necessary for that service.
Before consent is given, the data subject shall receive, in clear and plain language, information on the controller, any joint controllers, recipients or categories of recipients relying on the consent, the purposes pursued, the categories of data concerned, the right to withdraw consent, and, where relevant, automated decision-making under Article 22 or transfers to a third country without an adequacy decision or appropriate safeguards. Consent requests shall be clearly distinguishable from other matters and shall not be concealed within general terms and conditions.
Consent interfaces shall not deceive, coerce or manipulate the data subject, give greater prominence to acceptance than to refusal, make refusal, withdrawal or non-consent options less easy, less accessible or more time-consuming than acceptance, or repeat requests in a manner liable to pressure the data subject. Where an option to accept is presented, an equivalent option to refuse shall be presented at the same level of the interface.
Refusing or withdrawing consent shall be as easy as giving consent and shall not entail any cost, disadvantage or degradation of the service. Where consent was given through an electronic interface, withdrawal shall be possible through the same interface. Following withdrawal, the controller shall cease the processing concerned and, in the absence of another lawful basis, erase the data concerned.
Where consent is withdrawn or found to be invalid, the controller shall not retroactively rely on another legal basis under Article 6 to justify the same processing.
The controller shall be able to demonstrate that valid consent was given. The information retained for that purpose shall be limited to what is necessary.
Where this Regulation requires explicit consent, consent shall be given by an express statement.
Justification
Codifies the EDPB Guidelines 05/2020 on consent and 03/2022 on deceptive design patterns. Consent must be freely given, specific, informed and unambiguous; the interface must be fair and neutral and must not give visual or other prominence to acceptance over refusal, whether through size, colour, positioning or wording; refusal must be as easy to exercise, and as prominent, as acceptance; consent must be capable of being withdrawn as easily as it was given; and the controller may not retroactively rely on another legal basis where consent is withdrawn or found invalid. Consent obtained through a manipulated interface is not consent.
against:
Article 7a
Consent interfaces
- 1.
Any interface used to request, give, refuse or withdraw consent under this Regulation, including for the storing of, or access to, information in terminal equipment, shall be fair, neutral, intelligible and easily accessible.
- 2.
Consent shall be freely given, specific, informed and unambiguous. It shall be requested separately for each purpose and require a statement or clear affirmative action. Silence, inactivity, pre-ticked boxes or the mere continued use of a service shall not constitute consent. Fresh consent shall be required for any other purpose.
- 3.
Consent shall not be freely given where the data subject has no genuine choice, cannot refuse or withdraw consent without detriment, including in the presence of a clear imbalance between the data subject and the controller, or where access to a service, its functionalities or an equivalent version thereof is made conditional on consent to processing, storing or access that is not necessary for that service.
- 4.
Before consent is given, the data subject shall receive, in clear and plain language, information on the controller, any joint controllers, recipients or categories of recipients relying on the consent, the purposes pursued, the categories of data concerned, the right to withdraw consent, and, where relevant, automated decision-making under Article 22 or transfers to a third country without an adequacy decision or appropriate safeguards. Consent requests shall be clearly distinguishable from other matters and shall not be concealed within general terms and conditions.
- 5.
Consent interfaces shall not deceive, coerce or manipulate the data subject, give greater prominence to acceptance than to refusal, make refusal, withdrawal or non-consent options less easy, less accessible or more time-consuming than acceptance, or repeat requests in a manner liable to pressure the data subject. Where an option to accept is presented, an equivalent option to refuse shall be presented at the same level of the interface.
- 6.
Refusing or withdrawing consent shall be as easy as giving consent and shall not entail any cost, disadvantage or degradation of the service. Where consent was given through an electronic interface, withdrawal shall be possible through the same interface. Following withdrawal, the controller shall cease the processing concerned and, in the absence of another lawful basis, erase the data concerned.
- 7.
Where consent is withdrawn or found to be invalid, the controller shall not retroactively rely on another legal basis under Article 6 to justify the same processing.
- 8.
The controller shall be able to demonstrate that valid consent was given. The information retained for that purpose shall be limited to what is necessary.
- 9.
Where this Regulation requires explicit consent, consent shall be given by an express statement.
No amendments match these filters.
Selected texts
Compare wording
Choose a tracked part and a named pair of texts. Comparisons are offered only where both sides cover the same legal unit.
Select a specific tracked part above to compare wording.
No same-scope comparison is available for this tracked part. Its source wording remains available in the article text sections.