Consent: agreement to a specific use of information

Consent is a person’s agreement to a specific use of their information. The European Union’s General Data Protection Regulation (GDPR) defines it as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes.” My Vote Forward adopts that standard as a design floor everywhere, without claiming the regulation applies in every jurisdiction.

Definition

GDPR Article 4(11) defines consent as “any freely given, specific, informed and unambiguous indication of the data subject’s wishes,” given by a statement or clear affirmative action.⁠¹ Each word rules something out:

• Freely given: not forced, and not a condition of an unrelated service.
• Specific: tied to a defined purpose, not a blanket permission.
• Informed: the person knows what they are agreeing to.
• Unambiguous: shown by a clear act, not inferred from silence or a prechecked box.

Article 4(1) defines the information consent protects, personal data, as “any information relating to an identified or identifiable natural person”.⁠¹

Origin and history

Consent as a legal basis for using personal data is codified in detail in the GDPR, Regulation (EU) 2016/679. Article 7 sets the conditions.⁠² The controller “shall be able to demonstrate that the data subject has consented.” A request bundled into a longer document must be “presented in a manner which is clearly distinguishable from the other matters.” The person has “the right to withdraw his or her consent at any time,” withdrawal does not make earlier processing unlawful, and “it shall be as easy to withdraw as to give consent.” In judging whether consent is freely given, regulators must consider whether a service “is conditional on consent to the processing of personal data that is not necessary for the performance of that contract”.⁠²

Other legal systems use different bases and standards, and the GDPR’s reach depends on who processes whose data and where. That is why My Vote Forward describes GDPR consent as a design floor it chooses, not a law it claims to satisfy.

How consent is recorded and tested

Consent is only as good as the record of it. Because the controller must be able to demonstrate consent,⁠² a well-designed system stores, for each grant or withdrawal, the purpose, the scope, the wording version shown, the time, and the action taken. When the wording changes, earlier consent is not silently extended to the new wording.

Design patterns can undermine consent while appearing to ask for it: prechecked boxes, consent bundled with account creation, permission requests that reappear until accepted, and withdrawal buried several screens deep. Each violates at least one element of the definition.

Common confusions and neighboring terms

• Consent vs. notice. A privacy notice tells people what happens; consent asks them to agree. A notice alone is not consent.
• Consent vs. terms of service. Accepting terms to use a service is not specific consent to each use of data.
• Consent vs. secrecy. A person cannot consent away the secrecy of a ballot, because secrecy protects others from coercion too. Consent governs opinions and priorities, never votes.
• Consent vs. aggregate release. Including someone’s answers in a published statistic is its own use and needs its own basis.
• Withdrawal vs. deletion. Withdrawing consent stops future use; copies others already made, such as screenshots, may persist.

How My Vote Forward uses the term

My Vote Forward applies the GDPR standard as a floor across its demo and any future system, as set out in Consent. Every permission starts off and is granted by a clear action. People preview the exact snapshot before publishing an opinion. Consent records store purpose, scope, wording version, timestamp, and action. Revoking a share link removes the hosted copy where possible, and the interface warns beforehand that screenshots and downloads may persist. No permission touches ballot choices. Any future published release of real data would need its own documented consent basis and privacy review.

Unresolved questions

• How should consent be re-requested when wording changes, without causing fatigue that leads people to click through?
• Should a person be able to withdraw an opinion from an aggregate that has already been released, and what would that require?
• How can consent work for participants who are minors, where the law usually requires a parent’s involvement?