Freely given, specific, informed, unambiguous indication by the data subject — must be as easy to withdraw as to give.
Under GDPR Art. 4(11) and Art. 7, consent must be freely given, specific, informed, and unambiguous, indicated by a statement or clear affirmative action. Pre-ticked boxes, bundled consents, and ‘consent’ obtained from a position of clear imbalance (e.g. employer–employee) do not qualify.
Run a free ComplianceIQ audit against GDPR and we'll surface every gap on this — and the other controls auditors flag — with the exact clause references to fix.