GDPR Article 7 — Conditions for Consent (gdpr-info.eu)

Authoritative mirror of the official GDPR Article 7 text as published on EUR-Lex (CELEX:32016R0679).

Key provisions surfaced (2026-05-06):

• Art. 7(1) — Burden of proof on controller. Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented. (Controller bears the burden, not the data subject.)
• Art. 7(2) — Written declarations must be distinguishable. Where consent is given in the context of a written declaration covering other matters, the consent request must be clearly distinguishable; if the declaration infringes the GDPR, it is not binding.
• Art. 7(3) — Right to withdraw. The data subject shall have the right to withdraw consent at any time. Withdrawal must be as easy to give as consent. Withdrawal does not affect the lawfulness of prior processing.
• Art. 7(4) — Freely given. When assessing whether consent is freely given, utmost account shall be taken of whether performance of a contract is conditional on consent that is not necessary for that contract. Bundled consent ("consent or we can't serve you") is presumed not freely given.

Consent validity criteria (from GDPR Art. 4(11) and Recital 32): Consent must be: freely given · specific · informed · unambiguous (clear affirmative act). Pre-ticked boxes and silence are not valid consent.

Child consent (Art. 8): Under-16 requires parental authorization; Member States may lower threshold to 13.

Relationship to existing KG nodes:

• Grounds legal basis claims in modality.email and modality.sms governance bodies.
• Referenced by proposal TC-6 (concept.consent-management candidate drafted in evolution-log/2026-05-06/web-refresh.md).