IANAL This is why the GDPR requires that the default or most obvious option should be the one that denies use of personal data. Consent should be given by a cl

IANAL This is why the GDPR requires that the default or most obvious option should be the one that denies use of personal data. Consent should be given by a clear affirmative act [...] Silence, pre-ticked boxes or inactivity should not therefore constitute consent. [...] So, all those websites that have preticked boxes where you share data unless you untick them are in violation of the GDPR (unless the personal data is required for the site to function). So are websites that only present an 'accept/ok' option, since processing personal data is typically not necessary to retrieve the page: When assessing whether consent is freely given, utmost account shall be taken of whether, inter alia, the performance of a contract, including the provision of a service, is conditional on consent to the processing of personal data that is not necessary for the performance of that contract. Websites that are designed to let unattentive users consent to data by e.g. clicking the most visible button are probably in violation as well, since it is not a clear affirmative act.