Consent Model

Anyone who collects data about other people usually needs their permission in Europe. This permission is called consent. A consent model is the fixed procedure by which a company obtains and manages this permission. It answers three questions: When is the request made, for exactly what purpose, and how can you object later? The cookie banners that appear when you open almost any website are the most visible part of such a model. But there is considerably more behind it than a window with two buttons.

Permission as a Business Foundation

Large parts of the digital economy live off data. Advertising networks want to know which pages you visit in order to show you matching ads. Voice assistant providers want to analyze recordings in order to improve their systems. Without valid consent, this is simply prohibited in the EU. The consent model thus determines whether a business model is even legal in the first place.

For AI companies, this issue has become significantly more pressing in recent years. Models are trained with enormous amounts of text and images. Some of this data comes from real users, for example from chat histories or social networks. Whether these users agreed to this has repeatedly been the subject of legal proceedings. Meta already had to adjust its approach to training on posts from European users.

Violations are expensive. The General Data Protection Regulation, GDPR for short, allows fines of up to four percent of worldwide annual revenue. For a corporation with 100 billion euros in revenue, that amounts to up to four billion euros. Such sums have not yet been exhausted, but fines in the hundreds of millions have occurred multiple times.

From Checkbox to Withdrawal

The core of every consent model is the distinction between opt-in and opt-out. With opt-in, nothing happens until you actively agree. With opt-out, data use runs automatically, and you have to take care of switching it off yourself. The GDPR requires opt-in in most cases. Pre-checked boxes explicitly do not count as consent.

For consent to be valid, it must meet several conditions. It must be given voluntarily, meaning without disadvantage in case of refusal. It must relate to a specific purpose, not to everything at once. And it must be informed: you must be able to understand what you are agreeing to. A blanket yes for forty advertising partners barely meets this standard.

Technically, this task is often handled by dedicated software called a Consent Management Platform. It displays the banner, stores your decision, and passes it on to all involved services. Withdrawal is important: consent must be as easy to revoke as it was to give. In practice, this is often exactly the weak point. Agreeing takes one click, declining requires navigating through three submenus first. Such designs are called dark patterns and are regularly challenged by regulatory authorities.

Banners, Settings, and Training Data

You most commonly encounter a consent model as a cookie banner in your browser. Cookies are small files that a website places on your device to recognize you again. Since a ruling by the European Court of Justice, banners must offer a genuine option to decline. This is why they look different today than they did a few years ago.

The topic also comes up in AI products. With ChatGPT and similar services, there is a setting for whether your inputs may be used for training. For business customers, this use is usually excluded from the outset, while for free users it is often enabled by default. It’s worth taking a look at the privacy settings.

In business news, the term is usually encountered in the context of conflicts. A common misconception here is that consent is always required. The GDPR recognizes other legal bases, such as the performance of a contract or a legitimate interest. It is precisely over these alternatives that disputes arise: companies like to invoke legitimate interest because then they don’t need a banner. Authorities often see it differently.