The Significance of Implied Consent for Companies

What is implied consent?

Implied consent exists when a person does not declare their agreement explicitly but shows it through clear behaviour – for example by voluntarily handing a company their business card. Under the GDPR, such consent can be valid if it is freely given, informed, specific and expressed through a clear affirmative action. Silence, inactivity or pre-ticked boxes are never enough, and for health data, cookies and email marketing, implied consent is effectively ruled out.

Why consent is so important in data protection

The GDPR has applied directly in all EU member states since 2018 and governs when personal data may be processed. One of the possible legal bases under Art. 6 GDPR is consent. The GDPR defines it as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her” (Art. 4(11) GDPR).

In other words, data subjects must actively express their agreement. However, this does not always have to be done through an explicit statement. In certain circumstances, tacit agreement through clear behaviour – known as implied consent – is sufficient. In this article, you will learn what implied consent is and when it is sufficient.

When is implied consent valid?

Implied consent exists when a person’s behaviour clearly indicates that they agree to the collection and processing of their personal data – even without an explicit statement.

A typical example: at a trade fair, someone hands you their business card and asks for more information about a product. In this case, you may assume that the person agrees to being contacted for this purpose.

Important, however: implied consent is only valid under certain conditions. For it to be valid, several conditions must be met:

• The purpose must be recognisable to the person. They must know what their data will be used for before they act.
• The use of data must match this purpose. For example, someone who signs up for a tax blog does not automatically consent to marketing emails on completely different topics.
• The action must be voluntary and unambiguous. Someone who does not tick an optional box for marketing emails has not given consent.
• The information must be clear and easy to understand. Hidden references in lengthy terms and conditions are generally not sufficient to assume valid consent.

Distinction: Being an existing customer does not replace consent. German competition law provides an exception for email marketing to existing customers (Section 7(3) UWG), but it is subject to strict conditions and is not a form of implied consent.

What requirements apply under the GDPR?

The legal basis is found primarily in Art. 4(11) and Art. 7 GDPR, which set out when consent is valid.

Valid consent must be:

• freely given,
• informed,
• specific,
• unambiguous and given through an affirmative action,
• and revocable at any time (Art. 7(3) GDPR).

With implied consent in particular, the requirement of being unambiguous quickly becomes a problem.

When is behaviour clear enough?

For behaviour to count as consent, it must be clearly recognisable to the company that the data subject consented deliberately. The behaviour must therefore not be ambiguous or accidental. The GDPR requires an affirmative action. Mere inactivity is not sufficient.

Examples from practice

It becomes especially critical when users cannot clearly recognise what their data will be used for.

When is implied consent not sufficient?

The more sensitive the data processing, the higher the requirements for consent. In many cases, implied consent is therefore not sufficient.

Particularly critical areas

Health data and sensitive information

Special categories of personal data under Art. 9 GDPR, such as health data, are subject to particularly strict requirements. If processing is based on consent, that consent must be explicit (Art. 9(2)(a) GDPR). One example is the release from confidentiality, with which patients allow their health data to be shared.

Cookies and tracking

Since the rulings of the CJEU (Planet49, 2019) and the German Federal Court of Justice (Cookie Consent II, 2020), it has been clear: pre-ticked checkboxes or silent consent are not sufficient for tracking cookies. In Germany, this is now governed by Section 25 TDDDG. Users must actively give their consent.

Direct marketing

Caution is also needed in email marketing. For marketing emails and newsletters, companies generally need express consent (Section 7(2) UWG in Germany). The well-known double opt-in procedure therefore remains the safest approach.

Automated decisions and AI systems

When companies use AI systems or automated decision-making, transparency and information obligations increase further. Merely implied consent can quickly become insufficient here.

What risks do companies face?

The biggest challenge lies in demonstrability. Companies must be able to prove at any time that valid consent existed (Art. 7(1) GDPR). If this proof cannot be provided, the data processing may be considered unlawful.

Key risks at a glance

Fines and GDPR violations

Invalid consent can lead to data protection violations – including substantial fines.

Warning letters and reputational damage

In marketing especially, competition law warning letters are an additional risk. At the same time, a loss of customer trust can have long-term consequences.

The burden of proof lies with the company

Under the GDPR, it is not enough to simply assume consent was given.

Companies must be able to actively document:

• when consent was given,
• on what basis,
• and exactly what it was given for.

How companies obtain GDPR-compliant consent

In many cases, the safest solution remains explicit, documented consent. Companies should therefore make their processes as transparent and traceable as possible.

Best practices

Use clear and understandable language

Consent requests must not be hidden or unnecessarily complicated.

Obtain active consent

Checkboxes should be ticked voluntarily and never be pre-selected.

Use double opt-in

Double opt-in remains the most important standard, especially in email marketing.

Make withdrawal easy

Users must be able to withdraw their consent easily at any time – as easily as they gave it.

Document consent

Clean documentation significantly reduces risks during audits or complaints.

Why consent management is becoming increasingly important

The more digital tools, tracking technologies and AI systems companies use, the more complex managing consent becomes. Many companies quickly reach their organisational limits here.

Modern consent management solutions help you:

• document consent centrally,
• track withdrawals,
• fulfil documentation obligations,
• and manage data protection processes efficiently.

Conclusion: Implied consent remains legally sensitive

Implied consent can be valid under certain conditions. At the same time, it is significantly riskier from a GDPR perspective than explicit consent.

Whenever there is doubt about clarity, you should rely on clearly documented consent processes. Caution is especially warranted with sensitive data, marketing activities or AI-powered applications. After all, responsibility for lawful data processing always rests with the company itself.

Companies that establish transparent processes and document consent properly not only reduce legal risks but also strengthen the trust of customers and partners.

With heyData’s external data protection officer, you review your consent processes, set up cookie banners and forms with legal certainty and document everything in one place.

Take the first step: Book a free demo now