u/iubenda_team

Under the GDPR, consent only counts if it's freely given, specific, informed, and unambiguous, given by a clear affirmative action. Pre-ticked boxes, "by using this site you agree," and bundled all-or-nothing consent don't count. You also have to make withdrawing as easy as giving it, and be able to prove you got it.

Consent is one of the most misunderstood parts of the General Data Protection Regulation (GDPR), so here's the plain version. It comes straight from Article 4(11) and Article 7 of the regulation, plus the EDPB Guidelines 05/2020 on consent.

The four things consent has to be

- Freely given. The person needs a real choice, with no penalty for saying no. If access to your service is conditional on consent you don't actually need, it isn't free.

- Specific. One purpose, one consent. You can't collect a single yes and apply it to analytics, advertising, and profiling all at once. Each purpose gets its own option.

- Informed. Before they decide, people need to know who you are, what data you're collecting, why, and that they can withdraw at any time. Plain language, not buried in legalese.

- Unambiguous. It has to be a clear, affirmative action: ticking an unchecked box, flipping a toggle, clicking "accept." Silence or a pre-filled setting isn't agreement.

What doesn't count as consent

- Pre-ticked boxes or default-on toggles. The CJEU settled this in the Planet49 ruling.

- "By continuing to browse, you agree." Scrolling and continued use aren't consent.

- Bundling everything into one accept button with no way to refuse the non-essential stuff.

- Consent hidden inside your terms and conditions.

- Silence, inactivity, or a box the user never interacted with.

Two things people forget

- Withdrawal has to be as easy as giving consent (Article 7(3)). If it took one click to accept, it shouldn't take an email and three business days to undo.

- You have to be able to prove it (Article 7(1)). If a regulator asks, you need a record of who consented, to what, and when. A banner that collects consent but logs nothing leaves you exposed.

This is general information, not legal advice. If you're working through a specific setup, your DPO or legal team is the right call.

What trips you up most with consent on your own sites? Happy to dig into specifics in the comments.

Under the GDPR, consent only counts if it's freely given, specific, informed, and unambiguous, given by a clear affirmative action. Pre-ticked boxes, "by using this site you agree," and bundled all-or-nothing consent don't count. You also have to make withdrawing as easy as giving it, and be able to prove you got it.

Consent is one of the most misunderstood parts of the General Data Protection Regulation (GDPR), so here's the plain version. It comes straight from Article 4(11) and Article 7 of the regulation, plus the EDPB Guidelines 05/2020 on consent.

The four things consent has to be

- Freely given. The person needs a real choice, with no penalty for saying no. If access to your service is conditional on consent you don't actually need, it isn't free.

- Specific. One purpose, one consent. You can't collect a single yes and apply it to analytics, advertising, and profiling all at once. Each purpose gets its own option.

- Informed. Before they decide, people need to know who you are, what data you're collecting, why, and that they can withdraw at any time. Plain language, not buried in legalese.

- Unambiguous. It has to be a clear, affirmative action: ticking an unchecked box, flipping a toggle, clicking "accept." Silence or a pre-filled setting isn't agreement.

What doesn't count as consent

- Pre-ticked boxes or default-on toggles. The CJEU settled this in the Planet49 ruling.

- "By continuing to browse, you agree." Scrolling and continued use aren't consent.

- Bundling everything into one accept button with no way to refuse the non-essential stuff.

- Consent hidden inside your terms and conditions.

- Silence, inactivity, or a box the user never interacted with.

Two things people forget

- Withdrawal has to be as easy as giving consent (Article 7(3)). If it took one click to accept, it shouldn't take an email and three business days to undo.

- You have to be able to prove it (Article 7(1)). If a regulator asks, you need a record of who consented, to what, and when. A banner that collects consent but logs nothing leaves you exposed.

That last point is where a lot of otherwise-careful setups fall down. On the iubenda side, our Privacy Controls & Cookie Solution collects consent through the banner and keeps the timestamped record, so you can actually show what was agreed to. If you want to go deeper on what the cookie law and the GDPR actually require, this breaks it down: Cookies and the GDPR: what's really required. The principles above hold no matter what you use to implement them.

This is general information, not legal advice. If you're working through a specific setup, your DPO or legal team is the right call.

What trips you up most with consent on your own sites? Happy to dig into specifics in the comments.

Most people know websites use cookies and trackers, but email tracking still feels less visible.

A lot of marketing emails include a tiny hidden image that loads when the email is opened. Depending on the setup, that can send back things like the open event, timestamp, IP address, device/client info, and a unique identifier tied to the recipient.

That makes “open rate” less harmless than it sounds.

The Italian Garante has now taken the position that if this kind of email tracking can be tied back to an individual recipient, it should be treated much more like cookie-style tracking and require prior consent.

From a privacy point of view, this raises a pretty basic question:

Should opening an email count as a trackable action unless the person has clearly agreed to it?

A more privacy-respecting setup would make email tracking clear and optional, with a way to receive the email without individualized open tracking.

Most people know websites use cookies and trackers, but email tracking still feels less visible.

A lot of marketing emails include a tiny hidden image that loads when the email is opened. Depending on the setup, that can send back things like the open event, timestamp, IP address, device/client info, and a unique identifier tied to the recipient.

That makes “open rate” less harmless than it sounds.

The Italian Garante has now taken the position that if this kind of email tracking can be tied back to an individual recipient, it should be treated much more like cookie-style tracking and require prior consent.

From a privacy point of view, this raises a pretty basic question:

Should opening an email count as a trackable action unless the person has clearly agreed to it?

A more privacy-respecting setup would make email tracking clear and optional, with a way to receive the email without individualized open tracking.

If you run a WooCommerce store selling to EU consumers, the online withdrawal function under EU Directive 2023/2673 is now something to check.

People sometimes call it the “EU withdrawal button,” but it’s not only about adding a button. Where the right of withdrawal applies, customers need a clear online way to submit a withdrawal request.

For WooCommerce, the practical checks are:

can customers find the withdrawal option easily?
does the request reach the right support/refund/order workflow?
does the customer receive confirmation, usually by email?
do your Terms and Conditions explain the process correctly?
are exceptions handled clearly for custom goods, digital products, subscriptions, or services?

So the check is pretty simple: can a customer submit the withdrawal request online, get confirmation, and have that request handled properly by the store?

The Italian Garante has published guidance on the use of tracking pixels in emails, and it’s worth paying attention to if you rely on open tracking or behavioral email data.

The key practical point: when a tracking pixel can be linked to an individual recipient, it should not be treated as simple anonymous analytics.

For email teams, I’d be reviewing things like:

1. which newsletters or automations include tracking pixels
2. whether open tracking is connected to individual profiles or segmentation
3. whether users are clearly informed about email tracking
4. whether consent is collected in a specific enough way
5. whether users can refuse tracking without unsubscribing completely
6. whether consent records are stored and easy to prove later
7. whether there’s a no-tracking version for users who don’t consent

There are narrower cases where pixels may be used for technical or service-related purposes, but marketing, profiling, and behavioral tracking deserve a closer look.

Curious how email teams are preparing for this.

Are you changing consent flows, disabling open tracking, waiting for ESP updates, or treating this as an Italy-specific issue for now?

A cookie banner can look fine on the surface, but that doesn't always mean consent is working properly underneath.

One quick check we usually recommend:

1. Open the site in an incognito/private window
2. Don't click the cookie banner
3. Open DevTools and check the Network tab
4. Look for analytics, ads, pixels, embeds, or third-party scripts firing before consent
5. Then accept or reject and check whether tag behavior actually changes

The important part isn't just whether the banner appears. It's whether non-essential scripts are blocked before consent, and whether consent choices are reflected in tools like GTM or Google Consent Mode.

Curious how others are testing this in practice.

Are you using DevTools, GTM Preview, GA4 DebugView, a scanner, or something else?

Hey everyone! We’re u/iubenda_team, the team behind r/iubenda and one of the founding moderators here.

Welcome to r/iubenda, a community for practical conversations around data privacy, cookie consent, consent management, and compliance implementation.

This is a place to discuss topics like:

• GDPR, CCPA/CPRA, LGPD and other privacy laws
• cookie banners and consent management platforms
• Google Consent Mode v2
• GTM, WordPress, Shopify, Webflow and app integrations
• privacy policies, cookie policies and Terms & Conditions
• Complianz by iubenda
• real-world privacy and consent challenges

What to post

Share questions, experiences, ideas, implementation tips, interesting privacy news, or things you’re seeing in the market.

A few examples of topics that fit well here:

Google Consent Mode v2 setups, cookie banner implementation, WordPress/GTM consent workflows, privacy policy questions, and real-world GDPR or CCPA compliance challenges.

A quick note on support

This community is not meant to replace official iubenda support.

If you have an account-specific issue, billing question, private configuration problem, or urgent product support request, the fastest and safest path is still to contact iubenda support directly.

That said, general questions, implementation discussions, and shared learnings are very welcome here.

Community vibe

Helpful, practical, constructive.

We want this to be a useful space for developers, marketers, founders, agencies, privacy teams, and anyone working on consent and privacy compliance.

Introduce yourself, share what you’re working on, or post a question. Even a small implementation detail can start a useful discussion.

Thanks for being here, and welcome to r/iubenda.