Requirement
Consent must be freely given, specific, informed and unambiguous, evidenced by a clear affirmative act; it must not be bundled with other terms; and the data subject must be able to withdraw it at any time without detriment.
What the engine looks for
Every group below must be satisfied — by an affirmative statement, not a plan, a hedge or a denial — for the control to count as covered. A term ending in … matches any word it begins. Supporting terms do not change the verdict — they raise confidence and distinguish a policy that names a mechanism from one that gestures at a category.
Finding any of these outranks coverage — a policy that admits the gap is worse than silence.
Equivalent controls elsewhere
Matched on shared topics. Satisfying this control usually moves these too.
| Framework | Control | Title | Shared topics |
|---|---|---|---|
| GDPR | Art.7 | Conditions for consent | consent |
| CCPA/CPRA | Regs 7004 | Symmetric choices and no dark patterns | consent |
| GDPR | Art.6 | Lawful basis for processing | consent |
| GDPR | Art.21 | Right to object, including to direct marketing | consent |
| CCPA/CPRA | 1798.120 | Right to opt out of sale and sharing | consent |
| CCPA/CPRA | 1798.120(c)-(d) | Opt-in consent to sell or share minors' information | consent |
| CCPA/CPRA | 1798.121 | Right to limit use of sensitive personal information | consent |
| CCPA/CPRA | Regs 7025 | Honour opt-out preference signals (Global Privacy Control) | consent |