Foundational EU guidance from 2020, presented as an explainer rather than breaking news.
What happened
The EDPB’s consent guidelines explain the GDPR standard: consent must be freely given, specific, informed and unambiguous. They address issues including withdrawal and the quality of the choice offered. The guidance is an EU reference, not a substitute for checking applicable national rules or the UK’s current framework.
Source: EDPB — original source ↗
What it means for your website
Walk through your website as someone who does not know your business. Can they tell which choice is optional? Can they refuse without losing unrelated functionality? If they change their mind, can they find the control again? Avoid treating visual polish as evidence of valid consent. The wording, layout and underlying behaviour all contribute to the experience. Test the journey on a phone as well as a desktop, because a visible alternative can become awkward or disappear on a smaller screen. Keep records of the design and configuration you tested so later changes can be compared.
Three useful next steps
- Use clear, specific descriptions of optional uses.
- Test rejection and withdrawal on mobile.
- Retain the evidence and version of the consent interface.
Sources & context
Official sources consulted on 1 October 2026. A regulator’s announcement records its findings at that time; it is not proof of payment or the outcome of every later appeal.
EDPB — original sourceOur practical suggestions are GDPRFix commentary. A public website scan cannot establish your full legal position. For advice on a specific obligation or enforcement matter, use a suitably qualified adviser.