Passive Consent

Passive consent, also known as implied consent, is a form of consent inferred from a person's actions or inaction rather than through explicit agreement. This occurs when consent is presumed from circumstances, such as continuing to use a service after being notified of terms, not opting out when given the opportunity, or engaging in conduct that reasonably indicates agreement. Passive consent is controversial in privacy law because it doesn't require active, informed decision-making. The GDPR explicitly rejects passive consent as valid—silence, pre-ticked boxes, or inactivity cannot constitute valid consent under Article 4(11). However, some jurisdictions still recognize passive consent in limited circumstances, particularly for terms of service acceptance (browsewrap agreements) or when continuing an existing relationship after notice of changes. Even where passive consent is technically allowed, it's increasingly viewed as insufficient for privacy compliance. Courts have been skeptical of browsewrap agreements where consent is passive rather than active (clickwrap). Best practice moves toward active consent mechanisms where individuals must take affirmative steps. The risk with passive consent is that it may not withstand legal scrutiny, particularly for sensitive data processing or in jurisdictions with strong privacy protections.