Consent
Consent, in data protection law, is a freely given, specific, informed and unambiguous indication of a person's wishes, expressed by a statement or a clear affirmative action, that allows the processing of their personal data.The definition comes from Article 4(11) of the GDPR and is borrowed by the ePrivacy Directive for cookies, so the same standard decides whether a cookie banner works. Each adjective matters. Freely given: the person must have a real choice, so a cookie wall or a service made conditional on unrelated tracking fails. Specific: one consent per purpose, not a bundle. Informed: who processes what, why, for how long and with whom, before the choice. Unambiguous, by a clear affirmative action: a click on Accept, not silence, scrolling or a pre-ticked box (Recital 32).
Article 7 adds conditions: the controller must be able to demonstrate consent, the request must be clearly distinguishable from other matters, and withdrawing must be as easy as giving. Children's consent for online services needs parental authorization below an age member states set between 13 and 16.
Other laws use similar words. Brazil's LGPD wants consent that is free, informed and unequivocal; Türkiye's KVKK asks for explicit consent; Quebec's Law 25 for consent that is clear, free, informed and purpose-specific; South Africa's POPIA for a voluntary, specific and informed expression of will. California does not rely on consent for cookies at all and gives an opt-out instead. For the timing requirement, see prior consent.