Consent you can actually prove
In b1 the checker kept assuming a clean answer to one question: do you have consent? This session earns that answer. Real consent is not "we think they agreed" - it is a positive action the person took, on a clear notice, that you recorded. Get those three right and you have a lawful basis that overrides the register and survives a query. Get them wrong and you have a marketing list built on sand.
What valid consent looks like 8 min live
Consent is not a checkbox - it is a moment where a person, having been told plainly what they are agreeing to, does something to say yes. The good flow and the bad flow below look similar on a screen and are worlds apart in law.
LivePositive action, on a clear notice3 min▶
Under s.14 of the PDPA, consent must be clear and unambiguous. In practice that means the person took a positive action to agree - ticked an empty box, typed their number into a field labelled for marketing, replied "YES" to a keyword. What is not consent:
- A pre-ticked box. If the default is "yes" and the person did nothing, they did not consent. Inaction or failure to opt out is not a clear-and-unambiguous yes.
- Silence or "continuing to use the site". Passive states are not positive actions. The person has to do the agreeing.
- A notice buried where no reasonable person would read it. Clear means clear - the purpose has to be visible at the moment of the action.
LiveTwo limits: reasonableness and honesty3 min▶
Even a positive action is not enough if you asked for too much or asked dishonestly. Section 14 draws two hard lines:
- You cannot require consent beyond what is reasonable to provide the product or service. Making marketing consent a condition of buying a kettle is over-reach - the sale does not need it, so you cannot force it as a bundle.
- You cannot obtain consent by false or misleading means. If the person agreed because you misrepresented what they were agreeing to, that consent is not valid - it is deemed not given.
- Separate the asks. Consent to fulfil the order and consent to market are different purposes. Bundle them and the marketing consent is tainted.
Deemed consent + withdrawal 8 min live
Sometimes you do not need to ask, because the person's own conduct or the transaction supplies the consent - that is deemed consent. And whenever consent exists, the person can take it back. Both paths are below.
LiveThe three deemed-consent routes3 min▶
Deemed consent means the law treats consent as given without an explicit tick, in three defined situations:
- By conduct (s.15(1)). The person voluntarily provides their data for a purpose that is obvious in context - handing over a phone number to book a delivery slot deems consent to use it for that delivery. It does not deem consent to market to them.
- By contractual necessity (s.15(3)). Where sharing the data is reasonably necessary to conclude or perform a transaction the person is party to, consent is deemed - and it can extend downstream to a party you need to involve to deliver.
- By notification (s.15A). You may deem consent for a new purpose if you assess it will have no adverse effect on the person, tell them about it, and give a reasonable period to opt out before you proceed. This one requires a documented assessment - it is not a free pass.
LiveWithdrawal, and the records to keep3 min▶
Consent is never permanent. Under s.16 an individual may withdraw at any time, on reasonable notice:
- You must not prohibit withdrawal - no "you agreed forever" clauses. You may inform the person of the likely consequences (for example, they will stop getting offers), but you cannot block the withdrawal itself.
- Cease use on withdrawal. Once withdrawn, you stop using the data for that purpose. The PDPC rule of thumb is to give effect within about 10 business days.
- Keep records of both. Record the consent you obtained (what, when, how) and every withdrawal. If the PDPC asks how you were entitled to market to someone, the record is your answer.
Marina Retail fixes its sign-up form. Marina's old checkout had one pre-ticked box: "Keep me updated and agree to terms." It bundled the sale with marketing and defaulted to yes - failing on both positive action and reasonableness. The rebuild splits it into two empty boxes: one to complete the order (deemed by contractual necessity anyway), one clearly labelled "Yes, send me Marina offers by SMS" that the customer must tick themselves. Same page, now provable consent.
Rewrite a bad consent line ★ 10 min
The fastest way to internalise valid consent is to fix a broken one. Here is Marina's old line - repair it, then design the record you would keep.
| Marina's bad line (fix this) | Why it fails |
|---|---|
| "[x] Keep me updated and agree to terms" (pre-ticked, bundled) | Default yes = no positive action; sale and marketing bundled; not clear what "updated" means. |
Unbundle. Separate the order-completion consent from the marketing consent. The order can rely on contractual necessity; marketing needs its own ask.
Make it a positive action. Start unticked. Write a line the customer actively ticks - name the channel and who is sending. For example: "Yes, send me Marina Retail promotions by SMS. Unsubscribe any time."
Design the record. Sketch the fields you would store on each tick: customer ID, exact consent text shown, channel, timestamp, source page, and a matching withdrawal field. This is what you show the PDPC.
Reflect. In one line: where in your real sign-up flow does a person actually take a positive action to be marketed to - and can you prove it today?
Before session b3 ◐ 40 min total
- Screenshot your organisation's main sign-up or checkout consent. Mark every place it fails positive action, reasonableness, or bundling.
- List which of your marketing uses rely on express consent versus a deemed-consent route - and for each deemed one, name which of s.15(1), s.15(3), or s.15A applies.
- Find out how a withdrawal request reaches your team today and how long it takes to cease use. Is it under 10 business days?
- Read: the PDPC Advisory Guidelines on Key Concepts - the sections on Consent, Deemed Consent, and Withdrawal of Consent.
Official sources covered
Taught from the PDPC's own guidance on consent. This page covers ~80% of its working content on obtaining and recording consent - deeper obligations land in later sessions.
Three questions before you go 🎯 ◐ 90 seconds
1 · Your checkout has a pre-ticked "keep me updated" box. A customer completes the order without touching it. You have...
Valid consent (s.14) needs a positive action on a clear notice. A pre-ticked box and failure to opt out is not clear-and-unambiguous consent - the person has to do the agreeing.
2 · Which is a genuine deemed-consent route under the PDPA?
Deemed consent by notification (s.15A) requires a documented no-adverse-effect assessment plus notice and a reasonable opt-out window. A bought list or a short non-reply is not deemed consent.
3 · A customer withdraws marketing consent. You must...
Under s.16 you cannot prohibit withdrawal; you may inform of consequences, then must cease use - the PDPC rule of thumb is about 10 business days - and record the withdrawal.