I've been trying to find if it's obligatory to store in a database the consent given by an user regarding the ToS and Privacy Policy, but at best what I can find is sentences saying "should".

So my question is, is it obligatory to keep track of said consent in a database or is it fine enough if I prevent an user to use my services if they don't consent to my ToS and Privacy Policy (with the possibility of withdrawing said consent and the possiblity of renovating it in case the documents got changed)?

  • 1
    If you cannot continue registration without agreeing to the ToS or PP, then that would imply that the person agreed to such, so I don't see a reason that this would need to be stored.
    – Ron Beyer
    Sep 2 '19 at 17:58
  • Consent is only consent if it is freely given (GDPR 4.11). If you cannot continue registration without "agreeing" to some document, then that satisfies the need to inform users about the processing, but you need to have some legitimate basis for processing that data other than consent (for example, the legitimate needs 7.1f clause), as a mandatory agreement does not constitute freely given consent (recital 43 gdpr-info.eu/recitals/no-43, and article 7.4).
    – Peteris
    Sep 2 '19 at 19:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.