Consent

Getting clear permission before collecting biometric or personal data.

Before a service scans a face or stores personal details, it asks the person, explains what it will do, and records their answer.

A freely given, specific, informed, unambiguous, and recorded authorization for a defined processing purpose. Processing means any operation on data, such as collecting, storing, or using it.

The EU's General Data Protection Regulation (GDPR) describes valid consent with several requirements:

• Freely given, meaning the person has a real choice and is not pressured or penalized for refusing.
• Specific, meaning it covers a stated purpose and not a vague bundle of uses.
• Informed, meaning the person knows who is collecting the data and why.
• Unambiguous, meaning it takes a clear action, so pre-ticked boxes and silence do not count.

Sensitive data such as biometrics raises the bar. Under GDPR, the exception most identity flows use for biometric data is explicit consent, and Illinois's Biometric Information Privacy Act (BIPA) requires a written release.

A consent flow typically includes these steps:

1. The service shows a clear notice of what is collected, why, and for how long.
2. The person gives a clear affirmative response.
3. The service records the consent, including when and what the person saw.
4. The person can withdraw consent as easily as they gave it.

Consent sits next to terms that are easy to mix up:

• BIPA is the Illinois law that requires written consent for biometrics.
• GDPR is the EU law that defines valid consent and treats biometrics as sensitive.
• Data minimization limits what is collected, which narrows what consent has to cover.

For more, see the Privacy Hub.