Consent cannot be inferred. It cannot be implied. A badly written opt-out buried in terms and conditions is not consent.

The 1995 Data Protection Directive defines consent as:

“Any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”

The ePrivacy Regulation (PECR) is set to particularise GDPR for electronic communications and is focused only on electronics — devices, processing techniques, storage, browsers etc.

It is the successor to the current ePrivacy Directive, known as the ‘Cookie Law’ because it has governed the statement frequently seen on Europe-based sites that declares users agree to the use of cookies if they agree to use the site.

According to the e-Privacy rules of email marketing (Reg.22), marketing emails & texts should not be sent to individuals without specific consent, although there are limited exceptions for existing customers. 

When seeking to acquire informed consent the default solution tends to be that you can obtain a written consent from each and every customer. This is of course perfectly fine, if it is manageable. But even  overcoming this task leaves the burden of gathering the consent documents and filing them, followed by ensuring the data is correct etc.

Remember, consent is just one of the ways in which processing data might be justified. Therefore, consider the processes that you are seeking consent to carry out, and look at alternative lawful bases.

In respect of the data subject enforcing their rights, it should first be noted that withdrawing consent, i.e. removing the controller's right to use your data, is not the same as the right of erasure. Consent is specific and unambiguous and is given for a particular activity.

For example, many of us will use an online web form to download a document. If there is a check box to receive marketing material from the site, and we tick the box, we will receive the marketing materials. 

If we later withdraw the marketing consent, will our information be erased as well?