A GDPR consent example is worth more as a pair of examples: one that works and several that do not, because the failures are more instructive. Consent has to be freely given, specific, informed and an unambiguous indication by a clear affirmative action, and each of those four words rules out a pattern that is still extremely common on small business sites.
One that works
A newsletter box on a blog. The field asks for an email address. Below it, unticked, a single checkbox reading: send me the monthly newsletter about privacy paperwork for small companies. You can unsubscribe from any email. Beside it, a link to the privacy notice. Pressing subscribe stores the address, the wording of the checkbox as it stood that day, the timestamp and the page it came from. That is specific about the purpose, informed about what arrives, freely given because nothing else is conditioned on it, and unambiguous because a box was ticked.
Four that do not
A pre-ticked box, which is not an affirmative action. A single tick covering the terms, the privacy policy and marketing together, which is not specific and not freely given because the service depends on it. A statement that continuing to use the site constitutes consent, which is not an action. And a checkbox reading I agree to receive communications from us and our partners, which is not informed, because a reader cannot know who the partners are or what they will send.
The record is the evidence, and a flag is not a record
A controller has to be able to demonstrate that consent was given. A boolean column saying true demonstrates nothing: it does not say what was agreed to, when, or what the person was shown. The record needs the person, the purpose in words, the timestamp, the wording as displayed and the route the consent came in by. Withdrawal is recorded the same way and has to be as easy as giving it was, which in practice means an unsubscribe that works in one click.
Questions people ask about GDPR consent example
Do we need consent for everything?
No, and over-using it is a common error. Contract, legal obligation and legitimate interests cover most ordinary processing. Consent is for the things a person should be able to say no to without losing the service.
Does US marketing email need consent?
CAN-SPAM works on an opt-out basis rather than consent, but it does require a working unsubscribe, honouring it promptly, accurate headers and a postal address. European recipients bring the consent standard with them.
How long does consent last?
There is no fixed expiry. It lasts while it remains a meaningful indication of the person's wishes, which means a list nobody has engaged with for years is worth re-permissioning rather than defending.