> The types of consent explained: explicit vs implied, informed and unambiguous consent under the GDPR, with examples and what your cookie banner needs. > > Canonical: https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied [Best practices](https://www.flowconsent.com/en/blog?category=practices) # Types of consent: explicit, implied and informed consent explained By Roland Vekemans · Published 18 October 2026 · 8 min read In short The main types of consent in data protection are explicit (or express) consent, implied consent, informed consent and unambiguous consent given by a clear affirmative action. Under the GDPR, every valid consent must be informed and unambiguous, and explicit consent is required only for sensitive data, some automated decisions and some transfers. Implied consent, such as "by continuing to browse you accept cookies", is not valid for non-essential cookies in the EU or the UK. For a cookie banner, the standard is an active click on a clear choice, with refusal as easy as acceptance. ## What consent means under the GDPR Article 4(11) of the [GDPR](https://www.flowconsent.com/en/laws/gdpr) defines consent as a freely given, specific, informed and unambiguous indication of a person's wishes, given "by a statement or by a clear affirmative action". Recital 32 adds that silence, pre-ticked boxes and inactivity do not count. That definition already contains most of the "types" you will read about. Informed, specific and unambiguous are not separate kinds of consent you can choose between: they are conditions that every consent must meet. The only real choice the GDPR leaves is between ordinary consent (a clear affirmative action) and the stronger explicit consent. Everything else, implied consent first, falls short. For cookies, the [ePrivacy Directive](https://www.flowconsent.com/en/laws/eprivacy-directive) refers to the GDPR definition, so the same standard applies to storing or reading anything on a visitor's device. The full checklist of conditions is in our guide to [the 7 requirements for valid GDPR consent](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements). This article focuses on the labels people use and what each one means in practice. ## The types of consent at a glance - **Explicit consent** (also called express consent): an express statement, written or oral, confirming a specific purpose. Required by the GDPR in three situations. - **Unambiguous consent**: a clear affirmative action, such as clicking "Accept" or ticking an empty box. The default GDPR standard, and the one that applies to cookies. - **Informed consent**: consent given after receiving the information needed to understand what you agree to. A condition of every valid consent. - **Implied consent**: consent inferred from behaviour (continuing to browse, scrolling, not objecting). Not valid under the GDPR. - **Granular or specific consent**: a separate choice for each purpose, rather than one "I agree" for everything. - **Opt-in and opt-out**: two models. Opt-in means nothing happens until the person agrees; opt-out means processing runs until the person objects. - **Parental consent**: consent given by a parent or guardian for a child below the national age threshold. ## Explicit consent: when the GDPR requires it Explicit consent is a higher bar than ordinary consent. The GDPR requires it in three cases: - processing special categories of data, such as health, religion, sexual orientation or biometric data (Article 9(2)(a)); - decisions based solely on automated processing that have legal or similarly significant effects (Article 22(2)(c)); - transfers of personal data outside the EEA without adequate safeguards (Article 49(1)(a)). The EDPB guidelines 05/2020 on consent explain that "explicit" refers to the way consent is expressed. The person must confirm it in an express statement: a signed form, a written sentence, an email, an electronic signature, or a checkbox next to a sentence that names the specific purpose. A two-step confirmation (for example a form followed by a verification email) can also work. ### Explicit consent examples - A health app asks: "I agree that \[Company] processes my symptoms to suggest exercises", with an unticked box and a separate confirmation. - An online pharmacy collects a signed declaration before storing prescription data. - A recruitment platform asks for written confirmation before a fully automated rejection decision. On a regular website, cookies usually do not need explicit consent. They need unambiguous consent. The exception is when tracking reveals sensitive data, for example a site that builds advertising profiles from visits to pages about a medical condition. ## Unambiguous consent: the standard for cookies Unambiguous consent means the person did something that clearly signals agreement. Clicking a button labelled "Accept all", switching on a category toggle or ticking an empty box all qualify. The key word is action: something the visitor actively does. The Court of Justice of the EU confirmed this for cookies in the Planet49 judgment (C-673/17, 1 October 2019): a pre-ticked checkbox is not valid consent, because the user does nothing. The same logic rules out banners that treat closing the banner with the cross as acceptance. So what is the difference between explicit and unambiguous consent? Both require an active choice. Explicit consent adds an express statement tied to a specific purpose, often in writing. A click on "Accept" for analytics cookies is unambiguous, which is enough for cookies. It would not be enough to process health data. ## Implied consent: why it no longer works for cookies Implied consent is inferred from behaviour rather than given. Before 2018, many European banners relied on it: "By continuing to browse this site, you accept the use of cookies." Some regulators tolerated this. The CNIL's 2013 recommendation, for example, accepted continued browsing as a form of consent. That ended with the GDPR. The EDPB guidelines 05/2020 state that scrolling, swiping or similar activity on a page will never satisfy the requirement of a clear affirmative action. National regulators followed: - **France:** the CNIL guidelines of September 2020 removed continued browsing as a valid form of consent, with a compliance deadline of 31 March 2021. - **Spain:** the AEPD updated its cookie guide in July 2020 to drop "seguir navegando" (continuing to browse) as consent. - **United Kingdom:** the ICO states that implied consent is not valid for non-essential cookies under PECR, which uses the [UK GDPR](https://www.flowconsent.com/en/laws/uk-gdpr-pecr) standard of consent. ### Where implied consent still exists The term is still in use outside EU data protection. In medicine, a patient who rolls up a sleeve for a blood test gives implied consent. In Canada, PIPEDA accepts implied consent for less sensitive information when it matches what a person would reasonably expect, and the anti-spam law CASL distinguishes express and implied consent for commercial emails. In the United States, most state privacy laws follow an opt-out model for advertising cookies, which is closer to implied consent than to the GDPR. If your site targets European or UK visitors, none of these models changes what you must do for them. ## Informed consent: what people must know Informed consent is the oldest of these terms, borrowed from medical ethics. Under the GDPR, it means the person receives enough information before deciding. According to the EDPB, the minimum is: - the identity of the controller; - the purpose of each processing operation consent is asked for; - the type of data collected and used; - the right to withdraw consent at any time; - where relevant, the use of data for automated decisions and the risks of transfers outside the EEA. For a cookie banner, this means naming the purposes (analytics, advertising, personalisation) in plain words on the first layer and listing the services and cookies behind each one on the second layer. A banner that only says "We use cookies to improve your experience" is not informed. Hiding the choice behind confusing wording also breaks this rule: our article on [cookie dark patterns](https://www.flowconsent.com/en/blog/cookie-dark-patterns-cnil-prohibited) lists the designs regulators have sanctioned. Before writing your banner text, it helps to know what your site actually sets. Check in 30 seconds which cookies your site drops with the [free cookie scanner](https://www.flowconsent.com/en/scan). ## Granular consent: one choice per purpose Consent must be specific. If you use data for several unrelated purposes, people must be able to accept some and refuse others. On a cookie banner, this is why categories exist: a visitor can accept audience measurement and refuse advertising. One single "I agree" button that covers analytics, advertising and social media, with no way to refuse, is bundled consent and is not valid. Article 7(4) adds that consent must not be a condition for a service when the processing is not needed for that service. Article 7(3) requires that withdrawing consent is as easy as giving it, which in practice means a permanent link or button to reopen the banner. ## Opt-in vs opt-out consent Opt-in is the European model: no non-essential cookie is set and no tag fires until the visitor agrees. Opt-out reverses the logic: tracking starts by default and the visitor can object later, for example through a "Do Not Sell or Share" link under California law. Under the GDPR and ePrivacy rules, cookies that are not [strictly necessary](https://www.flowconsent.com/en/blog/strictly-necessary-cookies-examples) require opt-in. A banner that loads Google Analytics on arrival and offers a refusal afterwards is opt-out, and therefore non-compliant in the EU. ## Other forms: written, verbal and parental consent - **Written consent** is not required by the GDPR for ordinary consent, but it is the simplest way to obtain explicit consent. - **Verbal consent** can be valid, for example on a recorded phone call, but it is harder to prove. - **Parental consent** applies to online services offered directly to children. Article 8 sets the age at 16, and countries can lower it to 13: it is 15 in France, 14 in Spain, 16 in Germany and 13 in the UK. Whatever the form, Article 7(1) requires you to demonstrate that consent was given. For cookies, that means keeping a record of each choice: see [what to store as proof of cookie consent](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store). ## Which type of consent does your website need? For most websites, the answer is simple: 1. **Cookies and trackers that are not strictly necessary:** unambiguous, informed, granular opt-in consent, collected before anything loads. 2. **Strictly necessary cookies:** no consent, but information in your cookie policy. 3. **Sensitive data or fully automated decisions:** explicit consent, with an express statement and a record of it. 4. **Visitors outside Europe:** check local law, but applying the European standard everywhere is the simplest option and is accepted by opt-out regimes too. FlowConsent is one example of a banner built on the unambiguous opt-in model: it shows "Accept" and "Reject" with equal weight on the first layer and lets visitors choose category by category. ## How FlowConsent handles consent types FlowConsent collects the type of consent the GDPR expects for cookies: an active, informed and granular choice. Scripts that need consent are blocked before consent, so nothing fires until the visitor clicks. The banner keeps equal Accept and Reject buttons and granular categories, and customising its look does not change those defaults (see [banner customization](https://www.flowconsent.com/en/doc/banner-customization)). The automatic cookie scan lists the services on your site so each purpose is described accurately. Every choice is recorded, and you can export proof of consent at any time. Google Consent Mode v2 is built in, data is hosted in Europe and installation takes about ten minutes. FlowConsent is free up to 25,000 sessions per month, then Pro costs €14.99 per month for up to 100,000 sessions. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Ftypes-of-consent-explicit-implied) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Ftypes-of-consent-explicit-implied) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What are the different types of consent? In data protection, the usual types are explicit (express) consent, unambiguous consent given by a clear affirmative action, informed consent and implied consent. Under the GDPR, every valid consent must be freely given, specific, informed and unambiguous. Explicit consent is a stricter level required for sensitive data, some automated decisions and some transfers. Implied consent, inferred from behaviour such as continuing to browse, does not meet the GDPR standard. ### What is the difference between explicit and implied consent? Explicit consent is given through an express statement, such as a signed form, a written sentence or a checkbox next to a sentence naming the purpose. Implied consent is inferred from what a person does, for example continuing to browse or not objecting. The GDPR accepts the first and rejects the second: silence, inactivity and pre-ticked boxes never count as consent. ### Is implied consent valid for cookies? Not in the EU or the UK. The EDPB guidelines 05/2020 state that scrolling, swiping or continuing to browse never amount to a clear affirmative action. The CNIL, the AEPD and the ICO all reject banners that treat continued browsing as acceptance. Non-essential cookies need an active choice, such as a click on Accept, given before they are set, with an equally easy way to refuse. ### What is an example of explicit consent? A typical example is a health app that shows an unticked box next to the sentence "I agree that the company processes my symptoms to suggest exercises", followed by a separate confirmation. Other examples are a signed form, an email in which the person confirms a specific purpose, or an electronic signature. The statement must name the purpose clearly and be given by the person themselves. ### Does a cookie banner need explicit consent? Usually not. Cookies need GDPR-standard consent: freely given, specific, informed and unambiguous, which a click on a clear Accept button provides. Explicit consent, with an express statement for a named purpose, is only needed when tracking reveals sensitive data such as health or religion. In both cases, refusing must be as easy as accepting and you must keep a record of each choice. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Regulation · 4 March 2026](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work) ### [What are cookies? Types of cookies, how they work and what the law requires](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work) [A clear definition of cookies, how they work, every type of cookie (by origin, duration and purpose), what happens when you accept or reject them, and what European law requires of websites.](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work) [Read the article ](https://www.flowconsent.com/en/blog/what-are-cookies-types-how-they-work)· [Marketing tools · 1 July 2026](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) ### [The \_ga, \_gid and \_gat cookies explained: purpose, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [What the Google Analytics cookies \_ga, \_ga\_\, \_gid and \_gat actually do, how long they last, why they need consent in the EU and how Consent Mode v2 changes their behaviour.](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr) [Read the article ](https://www.flowconsent.com/en/blog/ga-cookie-gid-gat-explained-gdpr)· [Marketing tools · 29 June 2026](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained) ### [The \_fbp cookie (and \_fbc) explained: what it is, lifetime and GDPR consent](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained) [What the Meta cookies \_fbp and \_fbc contain, how long they last, how they feed the Conversions API and why they must stay blocked until your visitors consent.](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained) [Read the article](https://www.flowconsent.com/en/blog/fbp-fbc-cookies-meta-explained) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)