# Consent mechanism review
> Source: https://legalcode.md/skills/legalcode-consent-mechanism-review | [HTML version](https://legalcode.md/skills/legalcode-consent-mechanism-review)

Reviews consent collection mechanisms for validity under GDPR Article 7, EDPB Guidelines 05/2020 on consent, and EDPB Guidelines 03/2022 on deceptive design patterns.

Reviews consent collection mechanisms for validity under GDPR Article 7, EDPB Guidelines 05/2020 on consent, and EDPB Guidelines 03/2022 on deceptive design patterns. Detects dark patterns including pre-ticked boxes (Planet49), bundled consent, cookie walls, forced consent, asymmetric button design, confirmshaming, withdrawal obstruction, and consent fatigue tactics. Evaluates all four validity conditions — freely given, specific, informed, and unambiguous — plus withdrawal parity (Article 7(3)) and proof burden (Article 7(1)). Covers consent granularity (purpose-by-purpose), children's consent under Article 8 with national age thresholds, explicit consent for Article 9 special categories, power-imbalance contexts (employment, public authorities, large platforms), and consent refresh triggers. Assesses LGPD consent requirements (Brazil Articles 7–8, 11, 14), India DPDP Act 2023/Rules 2025 consent framework, UK ICO guidance and PECR cookie consent, CNIL recommendations (France), and US CCPA/CPRA opt-in requirements for minors and sensitive data. Produces consent mechanism audit report with COMPLIANT / REQUIRES REMEDIATION / NON-COMPLIANT classification per element, dark pattern identification with enforcement citations, remediation recommendations, compliant design patterns, and prioritised action plan. Use when auditing cookie banners, consent management platforms, account sign-up flows, app permission requests, or any consent mechanism before DPA review, product launch, or following enforcement enquiry.

This skill audits whether a consent collection mechanism meets the legal requirements for valid consent across the GDPR/UK GDPR, LGPD, DPDP Act, and US state privacy frameworks. It examines the mechanism itself — the banner, form, CMP, or flow — not the underlying processing activities. The consent mechanism is the operative moment where legal validity is created or destroyed. A technically sophisticated consent management platform with a well-categorised cookie inventory can still produce invalid consent if the interface design manipulates users. This skill exists to catch exactly that gap. **Covers:** - Core validity assessment: freely given, specific, informed, unambiguous (GDPR Art. 4(11), Art. 7) - Withdrawal parity test: as easy to withdraw as to give (GDPR Art. 7(3)) - Accountability proof: controller burden of proof and consent record adequacy (GDPR Art. 7(1)) - Dark pattern detection across the full EDPB six-category taxonomy (Guidelines 03/2022) - Consent granularity: per-purpose, per-vendor, no omnibus bundling - Children's consent: Article 8 EU thresholds (13-16) + UK (13) + national implementations - Special category explicit consent: Article 9 heightened standard - Power-imbalance contexts: employment, public authorities, dominant market platforms - Consent-or-pay analysis: EDPB Opinion 08/2024 freely given assessment - Cross-regime comparison: EU GDPR / UK ...

## Jurisdictions

Global



---
*Legalcode -- legalcode.md*