Definition · Plain-language
Consent management
Consent management is the process of obtaining, recording and managing individuals’ consent to the processing of their personal data over time.
The step most authors miss
Doing CRediT right? Don’t stop at the statement.
A CRediT statement credits you inside one paper. The recognition CRediT was built for happens when those roles are tied to you, persistently. Sign in with your ORCID — free — and claim your CRediT contributions on casrai.org, the home of the standard. They become a verified, portable part of your identity, not a line that disappears into one PDF.
Free: claim your contributions, then export a journal-ready CRediT statement, schema.org structured data, JATS XML, CSV or BibTeX — and preview your public profile. A membership publishes that profile publicly and verifies the journals you serve.
What consent management covers
Consent management is the lifecycle of handling consent: presenting clear information, capturing a person’s agreement to specific processing, recording exactly what they agreed to and when, and allowing them to change or withdraw that agreement later. Under the GDPR, valid consent must be freely given, specific, informed and unambiguous, shown through a clear affirmative action — so pre-ticked boxes or silence do not count. Managing consent therefore means more than collecting a one-off yes; it means maintaining a reliable, auditable record and respecting withdrawal just as readily as it was given.
Consent management platforms and cookies
Online, consent management is frequently delivered through consent management platforms (CMPs) — the cookie banners and preference centres many websites display. A CMP presents users with choices about cookies and similar technologies, records their selections, and signals those preferences to the systems that rely on them. Well-designed CMPs make accepting and rejecting equally easy and keep granular records. Cookie consent is governed not only by the GDPR but also by rules such as the EU ePrivacy regime, which is why consent for non-essential cookies is typically required up front.
Why records and withdrawal matter
Because consent is one lawful basis among several, an organisation relying on it must be able to demonstrate that valid consent was obtained — which makes record-keeping central to consent management. It must also make withdrawing consent as easy as giving it, and stop the relevant processing when consent is withdrawn. In a research setting, consent management intersects with, but is distinct from, research-ethics consent for participation. Treating consent as something to be actively managed over time, rather than captured once, supports both compliance and participant trust.
Key facts
At a glance
- Definition: obtaining, recording and managing individuals’ consent to data processing
- Valid consent: freely given, specific, informed and unambiguous (GDPR)
- No to: pre-ticked boxes, silence or inactivity as consent
- Tools: consent management platforms (CMPs), cookie banners
- Records: must be able to demonstrate consent was obtained
- Withdrawal: must be as easy to withdraw as to give
Common misconceptions
What people often get wrong
Often heard: A pre-ticked box or continued browsing counts as valid consent.
Actually: Under the GDPR, consent must be a clear affirmative action — freely given, specific, informed and unambiguous. Pre-ticked boxes, silence or simply continuing to browse do not constitute valid consent.
Often heard: Once someone consents, the organisation is done managing it.
Actually: Consent management is ongoing. Organisations must keep records demonstrating consent, allow people to withdraw it as easily as they gave it, and stop the relevant processing when consent is withdrawn.
Often heard: Consent is always the lawful basis you need for processing.
Actually: Consent is one of several lawful bases under the GDPR. Consent management applies where consent is the chosen basis; other processing may rely on grounds such as legitimate interests or public task, where consent is not the mechanism.
Going deeper
