Q: My GDPR consent is collected but our lawyer says it's invalid. How?

Q: My GDPR consent is collected but our lawyer says it's invalid. How?

A: Under GDPR, consent has to be freely given, specific, informed, and unambiguous. Most 'collected' consent fails one of those because of a UX shortcut.

The usual breaks:

— The consent box is pre-ticked. Pre-checked equals no consent under GDPR — the user must take a clear affirmative action.
— One checkbox covers marketing, data sharing with partners, AND profiling. That's not 'specific'; each purpose needs its own opt-in.
— You bundle consent into the terms so the user can't use the service without agreeing to marketing. Not 'freely given'.
— You don't log WHEN and WHAT was consented to, so you can't prove it later.

Fix: unticked boxes, one purpose per box, service usable without marketing consent, and a timestamped record of the exact text shown. Store consent like an audit trail, not a true/false flag.

Short version: pre-ticked, bundled, or unlogged consent is invalid. Specific, affirmative, and recorded.

Still stuck? Drop your case in the comments.