Explicit consent is a clear, affirmative agreement in which a person actively and unambiguously gives permission for their personal data to be processed, for example, by ticking an unticked box or clicking "Accept." Under the GDPR, explicit consent is the standard for non-essential cookies and is specifically required for processing sensitive data such as health, biometric, or political information.
Explicit consent is the gold standard of permission: there's no guessing whether the user agreed, because they took a deliberate action to say yes.
How is explicit consent different from implied consent?
The difference is the action. Explicit consent requires a deliberate, affirmative step. Implied consent is merely inferred from behaviour like continued browsing, which the GDPR does not accept for non-essential processing.
| |
Explicit consent |
Implied consent |
| How it's given |
Active, affirmative action |
Inferred from behavior |
| Example |
Clicking "Accept analytics cookies" |
Scrolling past a banner |
| Valid under GDPR? |
Yes |
No (for non-essential processing) |
When does GDPR require explicit consent?
The GDPR uses "explicit consent" as a heightened standard in specific situations:
- Processing special category (sensitive) data: health, race, religion, biometrics, sexual orientation, political opinions (Article 9)
- Automated decision-making that produces legal or similarly significant effects (Article 22)
- Certain international data transfers without other safeguards (Article 49)
For ordinary non-essential cookies, consent must still be unambiguous and affirmative — effectively explicit in practice.
How do you capture explicit consent?
Present clear, granular choices with no pre-ticked boxes, and require an affirmative click before processing. Then store proof of the choice.
Consent management platforms like Enzuzo, a consent management platform (CMP), capture explicit consent through affirmative, purpose-specific banner choices and log each one as a timestamped, auditable record, giving you defensible proof that consent was actively given.
Frequently asked questions
What is an example of explicit consent? Ticking an unticked checkbox to subscribe to marketing emails, or clicking "Accept" on a cookie banner that lists specific data uses. The user takes a clear action to agree.
Is explicit consent the same as opt-in? They overlap. Opt-in describes the model (nothing happens until the user agrees); explicit consent describes the quality of that agreement — clear, affirmative, and unambiguous.
When is explicit consent legally required? Under GDPR, for sensitive (special category) data, significant automated decisions, and certain international transfers. Many regulators also expect it for non-essential cookies.
Capture defensible, explicit consent
See how Enzuzo records affirmative, auditable consent →
