Updated Short Paper No. 20 on Consent under the GDPR
The Konferenz der unabhängigen Datenschutzaufsichtsbehörden des Bundes und der Länder (DSK, Conference of the Independent Data Protection Supervisory Authorities of the Federation and the Länder) has updated its Short Paper No. 20 “Consent under the GDPR”. The update was adopted at the 3rd interim conference of the Datenschutzkonferenz on 23 September 2026. This interim conference was held as a video conference; in 2026, the Datenschutzkonferenz is chaired by the Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg (State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg).
The Datenschutzkonferenz provided information on the results of the interim conference in a press release dated 24 September 2026. In addition to the updated short paper on consent, the announcement also addressed further topics, including guidance on video surveillance in gyms, statements on smart glasses and a resolution on security legislation.
Significance of Consent in Data Protection Law
Consent as a Possible Legal Basis
Consent is one of the bases provided for in the GDPR for the processing of personal data. It may only be relied on if the applicable requirements are complied with. The updated Short Paper No. 20 sets out the relevant requirements and takes into account Guidelines 05/2020 of the European Data Protection Board on consent under Regulation 2016/679.
For controllers, it is of considerable importance that consent is not merely obtained as a formality. The decisive question is whether it meets the requirements of the GDPR. Invalid consent cannot support the intended processing.
No Arbitrary Switching of Legal Basis
The short paper makes clear that it is not possible to switch freely between consent and other legal bases. In particular, invalid consent cannot subsequently be replaced without further ado by a legitimate interest. According to the paper, infringements may give rise to fines and claims for damages.
The Datenschutzkonferenz thereby emphasises that the choice of legal basis is not merely an organisational issue. Rather, it determines the lawfulness of the specific data processing and must correspond to the actual circumstances.
Requirements for Valid Consent
Freely Given, Specific and Informed
Under the GDPR, consent requires the data subject to indicate their wishes freely, for the specific case, in an informed manner and unambiguously. The data subject must be able to identify what they are consenting to and which processing operations the declaration is intended to cover.
The short paper thus emphasises the close purpose limitation of consent. General or unclear declarations do not meet the requirements if they do not provide the data subject with an adequate basis for their decision.
No Written Form Required in the General Case
According to the full text of the short paper, written form is not required for consent under the GDPR. An unambiguous indication of wishes is sufficient. This may also be given electronically or orally.
The term “electronically” is not to be understood within the meaning of § 126a BGB (German Civil Code). It is not a matter of electronic form in the civil-law sense, but rather of the possibility of giving consent via electronic means of communication as well, provided the other requirements are met.
Active Conduct as a Requirement
Inactivity Is Not Sufficient
The updated short paper emphasises that consent requires active conduct by the data subject. In particular, the following are not sufficient:
- mere silence,
- pre-ticked boxes,
- pure inactivity,
- mere continued use of a service,
- conduct such as continuing to scroll on a website.
This makes clear that the data subject must make a conscious decision. The paper expressly bases the requirements for active conduct on the case law of the Europäischer Gerichtshof (ECJ, Court of Justice of the European Union) in Case C-673/17 and of the Bundesgerichtshof (BGH, Federal Court of Justice) in proceedings I ZR 7/16.
Significance for Digital Offerings
This clarification is particularly relevant for digital services. Consent mechanisms must be designed in such a way that the data subject’s decision is based on an active act. According to the Datenschutzkonferenz’s presentation, merely passive conduct does not allow the conclusion that valid consent has been given.
This applies in particular to situations in which cookies, tracking technologies or comparable methods are used. The requirements of freely given consent and an active decision coincide here.
Freely Given Consent for Cookies and Tracking
Making Use of a Service Dependent on Consent to Tracking
If a provider makes the use of an internet service dependent on consent to cookies or tracking, the Datenschutzkonferenz generally does not regard the consent as freely given if there is no genuinely equivalent alternative without tracking. According to this view, the decisive factor is whether the data subject has a genuine choice.
Under this understanding, consent loses its basis if use of the service is in practice possible only in exchange for agreeing to additional data processing and no equivalent tracking-free alternative is provided.
Equivalence of the Alternative
The paper focuses on the actual equivalence of the alternative. It is therefore not sufficient for another usage option formally to exist if it is not comparable in terms of content or functionality. The key question remains whether the data subject has a realistic and equivalent alternative available.
The Datenschutzkonferenz places this issue within the framework of freely given consent. As a result, the validity of consent is assessed not in isolation by reference to the declaration itself, but also by reference to the circumstances in which it is obtained.
Controller’s Obligation to Provide Proof
Documentation of Each Individual Consent
Art. 7 Abs. 1 DS-GVO (Article 7(1) GDPR) obliges the controller to be able to demonstrate that the data subject has consented to the processing of their personal data. In the view of the Datenschutzkonferenz, it is not sufficient merely to refer to the proper design of the website.
Rather, documentation of the specific declaration of consent of each individual data subject is required. The proof must therefore relate to the individual declaration and not merely to the general technical or design configuration of the consent process.
Scope of the Requirement to Provide Proof
The obligation to provide proof applies to the controller. The controller must be able to demonstrate that the respective consent was validly given. According to the updated short paper, merely asserting that the procedure used was designed in compliance with data protection law is not sufficient.
This requirement underlines that consent must not only be obtained but also recorded in a comprehensible manner. The documentation serves to enable review by supervisory authorities and vis-à-vis data subjects.
Withdrawal and Special Case Groups
Withdrawal of Consent
Consent that has been given may be withdrawn. According to the short paper, withdrawing consent must be as easy as giving it. This is intended to prevent situations in which data subjects can consent easily, while later withdrawal is made more difficult by additional hurdles.
Withdrawal has effect for the future. Processing carried out on the basis of consent up to the time of withdrawal remains unaffected, provided the consent was valid until then.
Special Categories of Personal Data
Higher requirements apply to special categories of personal data. In these cases, explicit consent is required. This concerns the types of data specially protected under the GDPR, for the processing of which stricter requirements apply.
The short paper thus emphasises the increased need for protection of such data. In these cases, consent must clearly relate to the processing of these special categories of data.
Employment Relationship and Children
In the employment relationship, § 26 Abs. 2 BDSG (German Federal Data Protection Act) must be observed. Under this provision, special requirements apply, in particular regarding written form or electronic form of consent. This special rule must be taken into account alongside the requirements of the GDPR.
For children outside the scope of Art. 8 DS-GVO (Article 8 GDPR), the short paper states that capacity for insight is decisive. The key question is therefore whether the child can understand the implications of the consent.
Assessment of the Updated Version
Connection with Further DSK Short Papers
Short Paper No. 2 on supervisory powers and sanctions was also updated at the same time. The official authority overview states the date as 15 September 2026. This shows that the Datenschutzkonferenz is updating several fundamental guidance papers.
The updated Short Paper No. 20 is provided by state authorities as a non-accessible PDF file with a file size of 275.6 KB. Individual state portals temporarily still listed the paper as “under revision”.
Date of Adoption and Publication
For chronological classification, a distinction must be made between the adoption of the update and the public communication. The update was adopted at the 3rd interim conference on 23 September 2026. The press release on the results of this interim conference is dated 24 September 2026.
The decisive point remains that Short Paper No. 20 is available in an updated version and summarises the requirements described for consent under the GDPR.
Use and Licence Notice
According to the usage notice provided by the Datenschutzkonferenz, the short papers of the Datenschutzkonferenz may be used commercially and non-commercially without prior enquiry with a supervisory authority. This includes, in particular, reproduction, printing, presentation, modification, editing, disclosure to third parties and combination with one’s own data or third-party data to create new independent datasets.
According to the usage notice, the condition is that the source notice is included: Konferenz der unabhängigen Datenschutzbehörden des Bundes und der Länder (Datenschutzkonferenz), Datenlizenz Deutschland – Namensnennung – Version 2.0.
Significance for Companies and Data-Processing Bodies
The updated Short Paper No. 20 makes clear that consent under the GDPR is subject to several cumulative requirements. Freely given consent, an active indication of wishes, sufficient information, specific purpose limitation and demonstrability must all be satisfied together.
For companies, investors and other controllers, the classification of individual processing operations may have considerable economic and organisational significance. For questions on consent, documentation or the data protection assessment of digital processes, MTR Legal supports companies as part of its legal advice in data protection law.
