The ICO indicates the GDPR (Well UK GDPR now they've left the EU, but it hasn't had time to diverge yet) unambiguous consent is satisified by: > Clear affirmat

The ICO indicates the GDPR (Well UK GDPR now they've left the EU, but it hasn't had time to diverge yet) unambiguous consent is satisified by: > Clear affirmative action means someone must take deliberate and specific action to opt in or agree to the processing, even if this is not expressed as an opt-in box. For example, other affirmative opt-in methods might include signing a consent statement, oral confirmation, a binary choice presented with equal prominence, or switching technical settings away from the default. > The key point is that all consent must be opt-in consent, ie a positive action or indication – there is no such thing as ‘opt-out consent’. Failure to opt out is not consent as it does not involve a clear affirmative act. You may not rely on silence, inactivity, default settings, pre-ticked boxes or your general terms and conditions, or seek to take advantage of inertia, inattention or default bias in any other way. All of these methods also involve ambiguity – and for consent to be valid it must be both unambiguous and affirmative. It must be clear that the individual deliberately and actively chose to consent. So allow/decline is a "binary choice presented with equal prominence" as required but "allow/more info" or "allow/advanced settings" is not equal prominence (especially when visual styling emphasises Allow, or more info/advanced settings is buried in text. https://ico.org.uk/for-organisations/guide-to-data-protection/guide-to-the-general-data-protection-regulation-gdpr/consent/what-is-valid-consent/#what4 https://ico.org.uk/for-organisations/guide-to-data-protectio...