Consent cannot be inferred. It cannot be implied. A badly written opt-out buried in terms and conditions is not consent.

The 1995 Data Protection Directive defines consent as:

“Any freely given specific and informed indication of his wishes by which the data subject signifies his agreement to personal data relating to him being processed”

The ePrivacy Regulation (PECR) is set to particularise GDPR for electronic communications and is focused only on electronics — devices, processing techniques, storage, browsers etc.

It is the successor to the current ePrivacy Directive, known as the ‘Cookie Law’ because it has governed the statement frequently seen on Europe-based sites that declares users agree to the use of cookies if they agree to use the site.

According to the e-Privacy rules of email marketing (Reg.22), marketing emails & texts should not be sent to individuals without specific consent, although there are limited exceptions for existing customers.