Consent Requirements for Personal Data Collection

Consent Requirements for Personal Data Collection (CIPT: Data Collection, Use, Dissemination and Destruction)

Introduction
Consent is one of the most heavily tested topics in the IAPP Certified Information Privacy Technologist (CIPT) exam. It sits inside the domain covering the data life cycle: collection, use, dissemination and destruction.

For a privacy technologist, consent is more than a legal idea. It is something that must be designed, built, recorded, enforced and honoured inside systems. This guide explains:
• why consent matters
• what valid consent is
• how it works in practice and in technology
• how to answer exam questions on it

Why Consent Requirements Are Important
1. Legal compliance: Many laws make consent either a lawful basis for processing or a mandatory requirement in certain situations. Examples include:
• the EU GDPR and the ePrivacy Directive (cookies)
• COPPA in the US (children's data)
• CAN-SPAM and TCPA (marketing communications)
• Canada's PIPEDA and CASL
• Brazil's LGPD and China's PIPL
• various US state laws, such as CCPA/CPRA opt-outs and opt-in for sensitive data in Virginia, Colorado and Connecticut

2. Respect for individual autonomy: Consent puts the Fair Information Practice Principles (FIPPs) into effect, especially the principles of individual participation, choice and purpose specification. It gives people control over their information.

3. Trust and reputation: Organisations that collect data transparently and with meaningful choice build customer trust. Deceptive consent practices lead to regulatory action. In the US, the FTC treats them as unfair or deceptive practices under Section 5. In the EU, they bring large GDPR fines; CNIL, for example, fined Google and Facebook over cookie consent design.

4. Technical accountability: Without systems that capture, store and enforce consent, an organisation cannot prove it obtained consent. Under GDPR Article 7(1), the controller carries the burden of demonstrating consent.

5. Downstream data flows: Consent decisions must travel with the data to processors, third parties and analytics systems. The technologist's job is to make sure downstream uses respect the original choice.

What Consent Is
Consent is the data subject's agreement to the processing of their personal data. The GDPR definition (Article 4(11)) is the global benchmark. It describes consent as:
"any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her."

The key elements of valid consent
• Freely given: There is a real choice with no coercion or detriment. Consent is usually not free where there is a clear power imbalance, such as employer and employee or public authority and citizen. It is also not free when it is bundled as a condition of a service where the processing is not necessary for that service (GDPR Art. 7(4), the conditionality test).
• Specific: Consent is given for specific, defined purposes. Separate purposes need granular, separate consent.
• Informed: Before consenting, the individual must know:
◦ the controller's identity
◦ the purposes of processing
◦ the types of data
◦ the right to withdraw
◦ any automated decision-making
◦ any transfer risks
• Unambiguous: A clear affirmative act or statement is required. Silence, pre-ticked boxes and inactivity are not consent (Planet49 case, CJEU 2019).
• Explicit (where required): GDPR requires explicit consent for:
◦ special category data (Art. 9)
◦ automated decision-making (Art. 22)
◦ certain international transfers (Art. 49)
Explicit consent means an express statement, such as a written statement, a signed form, or a deliberate opt-in tick with clear wording.
• Withdrawable: It must be as easy to withdraw consent as to give it (Art. 7(3)). Withdrawal does not affect the lawfulness of processing carried out before it.

Opt-in vs. Opt-out
• Opt-in (affirmative consent): No processing happens until the individual actively agrees. This is the norm under GDPR and for sensitive data under many US state laws, COPPA (verifiable parental consent) and CASL.
• Opt-out: Processing happens by default until the individual objects. This is common in US sectoral and state models, such as:
◦ CCPA's "Do Not Sell or Share"
◦ GLBA's sharing with non-affiliated third parties
◦ CAN-SPAM commercial email
• Implied consent: Consent inferred from conduct, such as giving a business card or handing over a credit card to pay. It is accepted in some regimes (PIPEDA allows implied consent for non-sensitive data and reasonable expectations) but not where explicit consent is required.

Consent vs. Other Lawful Bases
Consent is NOT always the right basis. Under GDPR Art. 6 there are six lawful bases:
• consent
• contract
• legal obligation
• vital interests
• public task
• legitimate interests

Consent should be used when the individual has genuine choice and control. Do not use consent if you would process the data anyway without it. That is misleading and unfair. It is a frequent exam trap.

Special Categories and Special Populations
• Children:
◦ GDPR Art. 8 requires parental consent for information society services offered to children under 16. Member states can lower this to 13.
◦ COPPA requires verifiable parental consent for children under 13. Methods include a signed consent form, a credit card transaction, a video call, a check of government ID, or knowledge-based questions.
• Health data: HIPAA uses authorizations for uses beyond treatment, payment and healthcare operations (TPO). Examples are marketing and the sale of PHI.
• Biometrics: The Illinois BIPA requires informed written consent (a written release) before collection.
• Sensitive data under US state laws: Virginia, Colorado, Connecticut and others require opt-in consent. California instead offers a right to limit the use of sensitive personal information.

How Consent Works in Practice (The Technologist's View)

1. Notice and consent at the point of collection
Consent must be captured at, or before, the moment data is collected. Techniques include:
• Just-in-time notices: contextual pop-ups shown when the data is needed, such as a location permission request when a map feature opens.
• Layered notices: short summaries with links to fuller detail.
• Privacy dashboards and preference centres: one place to view and change choices.
• Mobile OS permission prompts: iOS and Android runtime permissions, and iOS App Tracking Transparency.

2. Granularity
Separate toggles for separate purposes, such as:
• analytics
• personalisation
• marketing email
• third-party advertising

Avoid "accept all or leave" designs where processing is not essential.

3. Consent Management Platforms (CMPs)
A CMP is software that:
• shows cookie and tracker banners
• records choices
• blocks non-essential tags until consent is given
• passes consent signals to vendors, such as the IAB Transparency and Consent Framework (TCF) string

4. Consent records (proof)
Store the following for each consent:
• who consented (an identifier)
• when (a timestamp)
• what they were told (the version of the notice)
• how they consented (method or UI)
• what purposes they agreed to
• whether and when they withdrew

These records support accountability and audits.

5. Propagating and enforcing consent
Consent flags should be attached as metadata to data records, a practice called data tagging or sticky policies. Downstream systems check the flags before processing. Withdrawals must reach:
• processors
• marketing tools
• data warehouses

6. Withdrawal and expiry
• Provide one-click unsubscribe links and easy toggles.
• Honour browser signals such as Global Privacy Control (GPC). This is mandatory under CCPA regulations and Colorado law.
• Refresh consent periodically. Regulators often suggest around 12 to 13 months for cookies.

7. Avoiding dark patterns
Dark patterns are manipulative interface designs, such as:
• pre-ticked boxes
• confirmshaming ("No thanks, I don't like saving money")
• a hidden reject button
• asymmetric button colours
• making a refusal harder than an acceptance

Consent obtained through dark patterns is not freely given and may be invalid. CPRA regulations, the EDPB guidelines and the FTC all address dark patterns explicitly.

8. Privacy by Design and Default
GDPR Art. 25 requires the most privacy-protective settings by default. Non-essential processing should be OFF until the user switches it on.

9. Changes of purpose
If you want to use data for a new, incompatible purpose, you generally need fresh consent or another lawful basis. This follows from purpose limitation.

Common Consent Scenarios in the CIPT Context
• Cookies and trackers: Under ePrivacy, consent is required for non-strictly-necessary cookies. Strictly necessary cookies, such as a shopping cart or security cookies, are exempt.
• Email marketing:
◦ The EU and Canada (CASL) generally require opt-in, with a soft opt-in for existing customers in some regimes.
◦ The US (CAN-SPAM) uses opt-out.
• Telemarketing and texts: The US TCPA requires prior express written consent for autodialled or prerecorded marketing calls and texts.
• Location data: Precise geolocation is treated as sensitive under many laws, so opt-in is usually required.
• IoT and voice assistants: Consent is hard to obtain where devices have little or no screen. Solutions include companion apps, audible cues, LED indicators and setup-time choices.
• Employee data: Consent is usually inappropriate because of the power imbalance. Use another lawful basis instead.

Exam Tips: Answering Questions on Consent Requirements for Personal Data Collection

Tip 1: Memorise the four pillars plus withdrawal. Freely given, specific, informed, unambiguous, and as easy to withdraw as to give. If an answer option breaks any of these, it is almost certainly wrong.

Tip 2: Pre-ticked boxes, silence and inactivity are never valid consent under GDPR. If a scenario describes a pre-checked box, the correct answer will flag it as invalid.

Tip 3: Watch for bundling. If consent to marketing is a condition of signing up for an unrelated service, it is not freely given. Look for the answer that separates (unbundles) the consents.

Tip 4: Know when consent is the WRONG basis. Typical cases:
• processing for employees
• processing required by law
• processing necessary to deliver a contract

In these cases, the best answer usually points to another lawful basis. Asking for consent when you would process the data anyway is a classic distractor.

Tip 5: Distinguish opt-in from opt-out by jurisdiction. EU, Canada (CASL) and sensitive data generally mean opt-in. US commercial email (CAN-SPAM) and the CCPA sale or share of personal information mean opt-out. Read the question carefully for the jurisdiction.

Tip 6: Explicit consent applies to special categories. These include health, biometric, genetic, racial or ethnic origin, religion, sexual orientation, political opinion and trade union data. For these, ordinary consent is not enough. The answer should involve an express, documented statement.

Tip 7: Children trigger heightened requirements. COPPA means verifiable parental consent for children under 13. GDPR Art. 8 sets 16 by default, which can be lowered to 13. Expect questions on appropriate verification methods.

Tip 8: Think like a technologist. CIPT favours answers that operationalise consent, such as:
• consent logging
• CMPs
• tag blocking until consent
• consent metadata travelling with the data
• honouring GPC signals
• privacy-protective defaults

When two answers seem legally correct, choose the one with the stronger technical implementation and accountability.

Tip 9: Burden of proof is on the controller. If a question asks how to demonstrate compliance, choose answers that involve keeping records, including:
• timestamp
• notice version
• method of consent
• purposes agreed to

Tip 10: Recognise dark patterns. Asymmetric buttons, a hidden reject option, confirmshaming or repeated nagging all undermine valid consent. The correct answer will offer equal prominence to Accept and Reject.

Tip 11: Withdrawal must be easy and effective. If withdrawal needs a phone call or a letter when consent was given with one click, that fails the test. Also remember that withdrawal must reach third parties and processors.

Tip 12: Strictly necessary cookies are exempt. Do not choose answers that demand consent for session, security or load-balancing cookies. Analytics and advertising cookies require consent under ePrivacy.

Tip 13: A new purpose means a new consent, or a compatibility assessment. If a scenario describes reusing data for a different purpose, look for the answer requiring fresh consent or a documented compatibility analysis.

Tip 14: Use the process of elimination. Reject options that:
• rely on implied consent for sensitive data
• bury consent in terms and conditions
• treat continued browsing as consent
• make the service conditional on unnecessary data processing

Tip 15: Read for qualifiers. Words like best, first, most appropriate and primary matter. Often several answers are partly right. Pick the one that most completely meets the consent requirements and is most privacy-protective.

Quick Revision Checklist
• Definition: freely given, specific, informed, unambiguous, affirmative action
• Explicit consent: special categories, automated decision-making, transfers by derogation
• Withdrawal: as easy as giving consent; not retroactive
• Proof: the controller must demonstrate consent; keep records
• Children: COPPA under 13 (verifiable parental consent); GDPR 16, can be lowered to 13
• Cookies: consent for non-essential; exemption for strictly necessary
• Marketing: opt-in (EU/CASL) vs. opt-out (CAN-SPAM); TCPA prior express written consent
• US state laws: opt-in for sensitive data; opt-out for sale, targeted advertising and profiling; honour GPC
• Design: granular choices, privacy by default, no dark patterns, just-in-time notices, CMPs, consent metadata

Conclusion
Consent requirements are where law meets engineering. For the CIPT exam, you need to know the legal standards for valid consent and how to put them into practice through system design, user interfaces, record keeping and downstream enforcement. Always ask two questions:
• Is the consent genuinely free, specific, informed and unambiguous?
• Can the organisation prove it and honour it throughout the data life cycle?

If the answer is yes to both, you are on the right track.