GDPR consent as a lawful basis for AI agents: when it works

Consent is usually the wrong lawful basis for an AI agent's processing. GDPR consent must be freely given, specific, informed, unambiguous and as easy to withdraw as to give. Most agents do work a customer cannot refuse without losing the service, so consent is not free. It fits only optional, separable uses that can stop the moment a person withdraws.

What does GDPR require of consent?

Consent is one of six lawful bases in Article 6. For it to be valid, in substance, it must be:

• freely given, with a real choice and no detriment for refusing; consent is unlikely to be free where there is a clear imbalance of power, or where a service is made conditional on consent to processing that the service does not need;
• specific to each purpose;
• informed, with the person told who the controller is, what the processing is for and that they can withdraw;
• unambiguous, given by a clear affirmative act, not silence or a pre-ticked box;
• withdrawable at any time, as easily as it was given, with withdrawal stopping further processing on that basis.

The controller must be able to show that consent was given. And where consent is requested in a document that also covers other matters, it must be clearly distinguishable.

Explicit consent, a higher standard used for special category data and for some automated decisions, requires an express statement.

Who must meet these conditions?

Any controller relying on consent. The choice of basis is the controller's, made before processing, and cannot be swapped later if consent turns out to be invalid. The wider choice is set out in GDPR Article 6 lawful basis for AI agents processing customer data.

Why does consent fail for most agent processing?

Three reasons, each tied to how agents work.

The agent is how the service is delivered. If the only way to get support, apply for a loan or manage an account is through a process an agent carries out, the customer cannot refuse the agent's processing and still get the service. Consent obtained under those conditions is not freely given. Contract or legitimate interests usually fit better.

Withdrawal must actually stop processing. If a customer withdraws consent, the agent must stop processing their data for that purpose. Many agent designs cannot do this cleanly: the customer's data is in shared memory, in retrieval indexes, in caches. If you cannot honour withdrawal, you cannot rely on consent.

Purposes are too broad to be specific. An agent can do many things. Consent to "AI-assisted servicing" is not specific to any one purpose, so it does not meet the standard for any.

There is also a trap. Firms sometimes ask for consent while really relying on another basis, "just to be safe". That misleads customers into thinking they have a choice they do not have, which is itself unfair.

When does consent fit?

Consent works for uses that are optional, separable and stoppable:

• An opt-in AI assistant offered alongside a full human service, where customers who decline get the same outcomes without it.
• Personalisation beyond what the service needs, such as an agent that uses a customer's history to suggest savings goals, offered as an optional feature.
• Use of conversation data to improve the firm's own agents, where customers can decline without any effect on their service, and their data can be excluded.
• Certain marketing by an agent, where electronic marketing rules require consent anyway.
• Explicit consent for special category data, where no other condition applies and the processing is optional, such as a customer choosing to share health information to get tailored support.

For India's different consent model, see DPDP Act consent and AI agents.

How do you rely on consent properly when it fits?

The seventh row is the one to test. Withdraw consent for a test customer and confirm the agent refuses to process their data for that purpose, everywhere it could.

What will a supervisor or auditor ask?

• Which agent processing relies on consent, and why not another basis?
• Can customers get the same service without consenting?
• Show us a withdrawal and what the agent did afterwards.
• How is consent recorded and versioned?
• Did you ask for consent anywhere you actually rely on another basis?

What does consent not settle?

It does not make unfair processing fair or excessive processing minimal; the other principles still apply. It does not allow solely automated decisions with significant effects unless it is explicit and the safeguards are in place. And it does not cover the model provider's own uses of data, which should be excluded by contract. For a quick answer to the general question, see what lawful basis an AI agent needs to process personal data, and for the full map, AI agent regulation, mapped to controls.

This is an explanation of the rules, not legal advice; confirm how they apply to you with counsel.