Misquoted Confidence: high
Primary source found, but the way it is quoted changes the subject, metric, population or precision.
Safe rephrasing
GDPR lists six lawful bases for processing personal data; consent is only one of them, alongside contract, legal obligation, vital interests, public task and legitimate interests.
What the source says
Processing shall be lawful only if and to the extent that at least one of the following applies: the data subject has given consent
European Union (GDPR Art. 6) — Regulation (EU) 2016/679, Article 6
- Commonly cited as
- "Under GDPR you always need consent"
- True origin
- European Union (GDPR Art. 6) — Regulation (EU) 2016/679, Article 6
- Type
- Stat check: A widely repeated statistic traced back to its origin.
- Year
- 2016 (applies since May 2018)
- Data as of
- In force
- Last checked
- Method & sample
- Text of the regulation (via gdpr-info.eu).
- Drift between quote and source
- Type: consent is one of six lawful bases (others include contract, legal obligation and legitimate interests)
- Email/cookie consent rules come mainly from the separate ePrivacy rules
- Interest
- n/a (statutory or regulatory text).
Sources we opened
- GDPR Art. 6 (gdpr-info.eu) primary