Germany

What Constitutes Valid Consent Under German GDPR?

100%
Must be freely given (no bundling)
Written
Documentation required (Art. 7(1) DSGVO)
The Short Answer

Valid consent under German GDPR requires unambiguous, freely given, specific, informed, and revocable agreement — documented separately from other terms and never presumed.

What the Law Says

Under German law, valid consent for data processing is governed by the EU General Data Protection Regulation (GDPR), directly applicable in Germany as the DSGVO, supplemented by the Bundesdatenschutzgesetz (BDSG). German courts and the Federal Commissioner for Data Protection (BfDI) apply a strict interpretation aligned with ECJ case law.

Consent must meet all five criteria under Art. 4 No. 11 and Art. 7 DSGVO: it must be (1) freely given, (2) specific, (3) informed, (4) unambiguous, and (5) revocable at any time. The BfDI emphasizes that pre-ticked boxes, silence, or inactivity do not constitute valid consent (BfDI, Guidance on Consent, 2023).

Under § 25 BDSG, additional safeguards apply when processing sensitive data (e.g., health or biometric data), requiring explicit consent unless another legal basis applies. The German Federal Court of Justice (BGH) confirmed in BGH, Urt. v. 28.04.2022 – VI ZR 227/21 that consent bundled with contract performance violates the 'freely given' requirement.

Statutory Text

Consent shall be freely given, specific, informed and unambiguous… by a statement or by a clear affirmative action.

— DSGVO (GDPR), Art. 4(11)
Statutory Text

When processing is based on consent, the controller shall be able to demonstrate that the data subject has consented.

— DSGVO, Art. 7(1)

What to Do

1

Use clear, standalone consent mechanisms (e.g., unticked checkboxes with plain-language explanations) — never bundle with terms or sign-up flows.

2

Document consent per Art. 7(1) DSGVO: record date, time, channel, exact wording presented, and version of the consent form.

3

Provide an easy, free, and equally simple way to withdraw consent at any time — and honor withdrawal without delay (Art. 7(3) DSGVO).

Sources

statuteVerordnung (EU) 2016/679 (DSGVO)statuteBundesdatenschutzgesetz (BDSG)guidanceBfDI Guidance on Consent (2023)

Related Questions

Data Breach Notification Requirements in GermanyCookie Consent Requirements in GermanyWhat can I do if a company has a data breach affecting me?Can AI learn from my personal data?

Not legal advice. This article is general information based on publicly available sources, written for educational purposes. Laws change and individual situations vary. Consult a licensed attorney in your jurisdiction before acting on anything you read here. Last reviewed: 2026-10-05.