We have updated our terms: the written walkthrough

Myth · “By continuing to browse, you accept”: it is written everywhere, so it must be valid.

The myth: “continuing means consenting” The official page of the Union describes the expected gesture, and it is not that one: expressly signalling your agreement, for example by signing a consent form or selecting yes in answer to a clear request. A sentence that converts your normal use of the service into an agreement does not create consent: it tries to do without obtaining any.

“When a company or organisation asks for your consent, you have to make a clear action agreeing to this, for example by signing a consent form or selecting 'yes' from a clear yes/no option on a webpage.”

In plain words: agreement is given through an express gesture, in answer to a clear request. Simply passing through the app is not that gesture.

Myth · The box was ticked, but I could untick it: so it was a real choice, so it counts.

The myth: “being able to say no means having said yes” The official page of the Union takes exactly this example to say the opposite: it is not enough to be able to opt out, you have to expressly opt in. The pre-ticked box reverses the burden of the gesture: you would have to act in order to refuse, while the law requires that you act in order to accept.

“It is not enough to simply opt out, for example by checking a box saying you don't want to receive marketing emails. You have to opt in and agree to your personal data being stored and/or re-used for this purpose.”

In plain words: the expected gesture is an express yes, not a missed no. A box ticked on your behalf is nobody's gesture.

Myth · It is in the terms I validated when I signed up: signed is signed.

The myth: “it is in the contract, so it holds” The paragraph that frames the form of consent ends with a sentence few people read: any part of such a declaration which constitutes an infringement of the Regulation shall not be binding. A forty-seven-page document does not armour-plate a badly formed consent request: it buries it, and burying it is precisely the problem.

“Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.”

In plain words: signing a document does not validate what, inside it, infringes the Regulation. A signature is not a magic varnish.

Myth · A private service does what it likes in its own house: if they cut me off, that is their right, I just have to accept.

The myth: “it is private, so it is permitted” The Regulation applies precisely to private services, and it anticipated this exact scene: making the service conditional on consent that is not necessary for its performance weighs with all its might against the free character of the agreement. Giving in does not erase that imbalance: it documents it.

“utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”

In plain words: service blackmail is exactly what the text says to examine first when asking whether an agreement was free.

Myth · If they cut my access I also lose my old runs: better to accept, I will see about it later.

The myth: “I accept provisionally, it does not really count” A recorded consent is a consent producing its effects, and nobody will come and ask whether you meant it. What the law offers you, faced with the dilemma, is not a half-hearted yes: it is an agreement whose freedom is assessed, with the utmost account taken of the pressure applied. Keep the proof of the threat instead of giving in silently.

“4. When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract.”

In plain words: a yes wrung out of you is still a recorded yes. The right exhibit is the cut-off threat, not your resignation.

Myth · A withdrawal needs justifying: I prepare two paragraphs of explanations for the legal department.

The myth: “you need a good reason to withdraw” The first sentence of the paragraph is complete in a few words: the right to withdraw consent at any time. No reason, no review, no file. The official page of the Union confirms it: you contact the data controller and withdraw your permission, at any time. The rest is stagecraft.

“If you previously gave your consent for a company or organisation to use your personal data, you can contact the data controller (the person or body handling your personal data) and withdraw your permission at any time. Once you've withdrawn your permission, the company or organisation can no longer use your personal data.”

In plain words: you make contact, you withdraw, that is the end of it. Once the withdrawal is lodged, the use stops.

Myth · Once my withdrawal is lodged, everything they have done with my data for three years becomes retroactively unlawful.

The myth: “withdrawal erases the past” The text sets the limit in the sentence right after the right: the withdrawal shall not affect the lawfulness of processing based on consent BEFORE its withdrawal. Your withdrawal cuts off the future, not the past. Knowing this limit saves you from demanding the impossible, and makes the rest of your request credible.

“The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.”

In plain words: what they did while your agreement was valid stays covered by that agreement. The withdrawal holds for what comes next.

Myth · If they claim I accepted, it is up to me to demonstrate the opposite, and I cannot prove a void.

The myth: “it is on me to prove I never said yes” The Regulation settled the question in the first paragraph of the consent article, and in the opposite direction: the controller shall be able to demonstrate that the person consented. The burden sits structurally with them, because they alone keep the records. You have nothing to prove: you have a demonstration to demand.

“Where processing is based on consent, the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data.”

In plain words: whoever relies on your agreement must be able to demonstrate it. Doubt does not work against you.

Myth · I clicked a blue button one day, so I have lost: complaining would achieve nothing.

The myth: “I clicked, so it is settled” This whole file, the single-button window, the pre-ticked box, the cut-off threat, the registered letter demanded, can be laid as it stands before the data protection authority of your country. The official page of the Union gives the route: a complaint directly to your national authority, an investigation, and an answer within three months. A disputed click is not a verdict: it is the very subject of the complaint.

“If you think your data protection rights have not been respected, you can make a complaint directly to your national data protection authority which will investigate your complaint and give you a response within 3 months.”

In plain words: thinking your rights were disregarded is enough to open the complaint, at home, with an answer due within three months.