What it asks for. Where processing relies on consent, the controller must be able to show that consent was given. A request for consent in a written declaration covering other matters must be clearly distinguishable, intelligible and in plain language. Individuals can withdraw consent at any time, as easily as they gave it, and whether consent is freely given depends on factors such as whether a service is made conditional on unnecessary consent.
In practice. Organisations record who consented, when, to what and how, keep the wording shown at the time and offer a simple withdrawal route. Consent requests are separate from terms and conditions and are not bundled. Evidence includes consent logs, versioned consent texts and records showing withdrawals are honoured across systems.
Common gaps. Withdrawal is often harder than giving consent, or is not propagated to downstream systems. Consent is also used where a power imbalance means it cannot be freely given.