OneTrust Certified Privacy Professional Practice Exam

Which of the following is true regarding user consent under GDPR?

1. Consent must be implicit

2. Consent can be bundled with other agreements

3. Consent must be specific, informed, and unambiguous

4. Consent is not required for data anonymization

The correct answer is: Consent must be specific, informed, and unambiguous

User consent under the General Data Protection Regulation (GDPR) must be specific, informed, and unambiguous. This means that individuals need to be clearly informed about what they are consenting to, including the specific purpose for which their personal data will be processed. Consent must be given freely, without any coercion, and it must be indicated through a clear affirmative action, such as checking a box or clicking a button. This requirement ensures that individuals maintain control over their personal data and that organizations respect their privacy preferences. The other options do not align with the principles set forth by GDPR. For instance, implicit consent does not meet the regulation’s standard, which emphasizes unequivocal affirmative actions taken by the user. Additionally, bundling consent with other agreements undermines the clarity and distinctiveness required for consent under GDPR. Lastly, although consent is not needed for anonymization because anonymized data falls outside the scope of GDPR, this is unrelated to the user’s explicit choice concerning their personal data. Thus, the focus on specificity, informativeness, and unequivocal nature highlights the importance of protecting individuals' rights under GDPR.