{
  "schema_version": "1.1",
  "id": "gdpr-requires-consent-for-all-marketing-data",
  "slug": "gdpr-requires-consent-for-all-marketing-data",
  "url": "https://groundedkit.com/claims/gdpr-requires-consent-for-all-marketing-data/",
  "api_url": "https://groundedkit.com/api/claims/gdpr-requires-consent-for-all-marketing-data.json",
  "claim": "GDPR requires consent before you can process any personal data",
  "commonly_cited_as": "\"Under GDPR you always need consent\"",
  "verdict": "misquoted",
  "verdict_definition": "Primary source found, but the way it is quoted changes the subject, metric, population or precision.",
  "confidence": "high",
  "rating": {
    "value": 2,
    "best": 5,
    "worst": 1
  },
  "origin": {
    "publisher": "European Union (GDPR Art. 6)",
    "title": "Regulation (EU) 2016/679, Article 6",
    "year": "2016 (applies since May 2018)"
  },
  "quote": "Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent",
  "method": "Text of the regulation (via gdpr-info.eu).",
  "drift": [
    "Type: consent is one of six lawful bases (others include contract, legal obligation and legitimate interests)",
    "Email/cookie consent rules come mainly from the separate ePrivacy rules"
  ],
  "interest": "n/a (statutory or regulatory text).",
  "safe_rephrasing": "GDPR lists six lawful bases for processing personal data; consent is only one of them, alongside contract, legal obligation, vital interests, public task and legitimate interests.",
  "sources": [
    {
      "title": "GDPR Art. 6 (gdpr-info.eu)",
      "url": "https://gdpr-info.eu/art-6-gdpr/",
      "primary": true
    }
  ],
  "kind": "stat_check",
  "as_of": "In force",
  "last_checked": "2026-10-17",
  "stale": false,
  "date_reviewed": "2026-10-17",
  "license": "CC BY 4.0",
  "license_url": "https://creativecommons.org/licenses/by/4.0/"
}