The 9 Different Types of Consent: General Consent to Revocable Consent

With a majority of U.S. internet users highly concerned about the safety of their personal data, both companies and regulators have increased scrutiny on how organizations handle user consent.

Different types of consent have emerged to address various contexts and levels of data processing. These consent types aim to establish a clear understanding between data subjects and data controllers or processors, and they aim to emphasize transparency and the protection of individuals' privacy.

Below, we review the most common types of consent that businesses encounter and how to set up best practices for data collection. 

• Informed Consent
• Explicit Consent
• Implied Consent
• Granular Consent
• General Consent
• Conditional Consent
• Ongoing consent
•  Presumed Consent
• Withdrawable Consent
  
  

9 Types of Consent 

To maintain ethical data practices, it’s crucial to understand and implement the appropriate consent mechanisms. Businesses don’t need to be reminded of privacy laws set forth by the General Data Protection Regulation (GDPR) in the European Union or the California Consumer Privacy Act (CCPA) in the United States. Both require that businesses obtain valid consent for the collection, processing, and sharing of personal data.

Companies need to be aware of the specific consent requirements stipulated by these regulations to ensure compliance. Failure to comply with consent obligations can result in severe financial penalties – as well as the loss of user trust, which can damage a business even more.

1. Informed Consent

A type of consent that has gained prominence with the introduction of GDPR is informed consent. Informed consent makes sure that individuals clearly understand the data processing activities that take place and the associated risks and rights.

Informed consent requires organizations to provide individuals with detailed information about the data collection, including:

• Purpose
• Data recipients
• Retention period
• Potential international transfers

An example of informed consent is when a site like Instagram or Facebook presents users with a comprehensive privacy policy that outlines how their data will be used, shared, and protected. With informed consent, individuals retain control of their information and hold companies to a higher standard of data privacy.

2. Explicit Consent

Another common type of consent is explicit or express, consent. This form of consent requires individuals to unequivocally provide their permission for their data to be collected and processed.

Explicit consent is typically sought for sensitive or special categories of personal data, such as health information, racial or ethnic origin, religious beliefs, or political affiliations. For instance, an online health platform would seek explicit consent from users before they gather a person’s medical history to provide personalized health recommendations.

When they obtain explicit consent, organizations make sure that individuals are fully aware of the specific data being collected and its intended purposes. It’s a type of consent that plays a vital role in data privacy because it promotes transparency, individual autonomy, and compliance with regulations.

3. Implied Consent

Implied consent, also known as passive consent or opt-out consent, is another type. Unlike explicit consent, implied consent is inferred from a person's actions or behavior. It assumes that individuals have provided consent when they engage in certain activities that inherently involve data processing.

An example of implied consent is when users visit a website and their IP addresses are logged to analyze website traffic. Although explicit consent may not have been directly obtained, it’s assumed that users are aware of the website's data collection practices since they willingly accessed it.

Cookie policies are another good example. When individuals continue to browse a website after being informed about using cookies through a cookie banner or privacy policy, their continued use is often considered implied consent for the website to place and access these data points on their device.

Implied consent is often used in situations where the data controller or processor assumes that individuals would generally agree to the data processing activity or when the processing is considered necessary for the performance of a contract or the provision of a service. However, note that passive consent should be based on clear and transparent information provided to individuals about their rights, the purposes of data processing, and the ability to opt-out.

4. Granular Consent

Granular consent emphasizes how important it is to offer individuals choices and control over specific aspects of data processing. Granular consent allows individuals to grant or withhold permission for different purposes or categories of data sharing. For instance, a mobile application may request separate consents to access various features:

• Device location
• Sending push notifications
• Collecting browsing history
• Enabling third-party data sharing

When organizations implement granular consent mechanisms, they respect users' autonomy and empower them to select the specific data uses they find acceptable. It’s a user-first privacy strategy that allows them to make informed decisions about specific aspects of data processing, and it makes sure that their privacy expectations are met.

5. General Consent

The other side of granular consent, general consent, grants permission for a broad range of data processing activities but doesn’t specify particular purposes or conditions. General consent is most often seen in online service agreements when users provide general consent for the collection, processing, and storage of their personal data necessary for the provision of the service.

6. Conditional Consent

Conditional consent is given with specific conditions or limitations on the agreement. In other words, individuals agree to the data processing under certain circumstances or for specific purposes but not for others.

For instance, a survey conducted by an organization may seek conditional consent, and participants agree to their responses being used for research purposes but not for marketing or third-party data sharing. Conditional consent allows individuals to have more control over the extent and scope of their data usage, and it enables them to set boundaries and specify their preferences.

Some common data collection practices that may require conditional consent policies include:

• Research studies
• Marketing communications
• Data sharing with third-parties
• Cross-border data transfers
• Personalization and profiling

7. Ongoing Consent

Ongoing consent, also known as dynamic consent, recognizes that individuals' preferences and circumstances may change over time. This mandate regularly seeks renewal or reconfirmation of consent to make sure that individuals remain aware of the data processing activities and have the opportunity to modify their consent choices.

Ongoing consent is particularly relevant in long-term relationships where data processing occurs over an extended period. A good example is how a cloud storage service might periodically prompt users to review and update their consent settings for data backup and synchronization. This type of consent promotes a continuous dialogue between individuals and data controllers or processors. It supports easy adjustments and alignment with evolving privacy preferences.

Common examples of ongoing consent include policies found in subscription services, but they can also be present in a user’s account management tools, privacy policy management, and data retention policies.

8. Presumed Consent

For presumed consent, consent is assumed or implied based on a legal or regulatory provision, societal expectations, or the specific context in which data processing occurs. It suggests that individuals are presumed to have consented to certain data processing activities unless they explicitly object or opt out. Presumed consent is typically used in situations where there is a compelling public interest or legal basis for data processing.

It's important to note that presumed consent should be applied cautiously and in compliance with applicable laws and regulations. The presumption of consent must be based on a well-defined legal or regulatory framework, with proper safeguards in place to protect individuals' privacy rights.

9. Revocable Consent

Revocable consent, also known as withdrawable consent, gives individuals the right to revoke or withdraw their previously-provided consent for the collection of their personal data. It emphasizes the principle that individuals should have the ability to change their minds and exercise control over their data at any time. More philosophically, this concept recognizes that consent is not a one-time event but an ongoing process that allows individuals to maintain autonomy and make decisions regarding their personal information.

While consent should generally be withdrawable, some situations may occur in which given consent isn’t revocable. For example, if data processing is necessary to comply with legal obligations imposed on the data controller, the organization may still be required to process user data—even if consent is withdrawn.

Consent Management Covers All Types of Consent

Consent management is a hot button topic for data privacy given new laws like Quebec Law 25 and the emergence of Google Consent Mode. At Enzuzo, we’ve developed a suite of tools to help companies manage every compliance obligation in their purview, no matter what types of user consent is collected.

For example, our consent management software allows businesses to build and launch a personalized cookie consent banner and manager for their website, eCommerce store, or mobile app in a matter of minutes. Enzuzo is a Google-certified CMP and 100% compliant with Consent Mode V2, giving you the trust that it's an ironclad solution vetted by experts.

Book a complimentary 1-1 strategy call to discuss your consent management requirements and how Enzuzo can help 👇