Consent management is how an organization captures, stores, and honors people's choices about how their data is used. In the age of AI it has to stretch to new purposes — training models, profiling, and automated decisions — each of which may need its own lawful basis or consent. The data you already hold does not automatically come with permission to feed a model.
What is consent management?
Consent management records what each person agreed to, lets them change or withdraw it, and enforces those choices everywhere their data flows. A consent management platform (CMP) is the system that does this and keeps an auditable record of who consented to what, and when.
Why AI changes consent
AI creates new purposes for data that was collected for something else. Under GDPR's purpose-limitation principle, you cannot freely reuse data for a new, incompatible purpose. Training a model, profiling individuals, or making automated decisions can each be a new purpose that needs its own justification, not a free ride on the original consent.
Consent, lawful basis, and AI
Consent is not the only way to process data lawfully. GDPR provides six lawful bases, and consent is one of them:
- Consent is one option. When used, it must be freely given, specific, informed, and withdrawable.
- Legitimate interests is often used for AI training, subject to a balancing test against people's rights.
- Special category data (health, biometrics, and more) needs a stronger condition, often explicit consent.
The right basis depends on the data and the purpose.
What good AI consent management looks like
- Granular purposes. Separate choices for analytics, marketing, and AI or model training.
- An auditable record. Proof of who consented to what, and when.
- Easy withdrawal. Withdrawing is as simple as giving consent, and it propagates everywhere.
- Enforcement downstream. Choices actually gate what data reaches a model, not just what a banner says.
How to implement it
- Map the AI-related purposes you process personal data for.
- Choose and document a lawful basis for each.
- Capture granular, withdrawable consent where consent is the basis.
- Enforce those choices so they actually gate data into AI pipelines.
- Keep an audit trail you can show a regulator.
Key takeaways
- AI training is often a new purpose that needs its own lawful basis.
- Consent is one of six GDPR lawful bases, not the only one.
- Good consent management is granular, withdrawable, and enforced downstream.
- Keep an auditable record of every choice.
Frequently asked questions
What is consent management?
Consent management is how an organization captures, stores, and honors people's choices about how their personal data is used. A consent management platform records what each person agreed to, lets them change or withdraw it, and enforces those choices across systems.
Does AI training require consent under GDPR?
Not always. Consent is one of six lawful bases under GDPR; controllers sometimes rely on legitimate interests for AI training instead, subject to a balancing test. Special category data usually needs a stronger condition such as explicit consent. The right basis depends on the data and the purpose.
What is the difference between consent and lawful basis?
Lawful basis is the broader concept: GDPR requires one of six legal grounds to process personal data. Consent is one of those six. Choosing consent means you must meet its standard — freely given, specific, informed, and withdrawable.
Can you use data collected for one purpose to train AI?
Not automatically. GDPR's purpose limitation principle restricts reusing data for a new, incompatible purpose. Training a model on data collected for something else may require a compatibility assessment or a fresh lawful basis.
What is a consent management platform?
A consent management platform (CMP) collects and stores consent, presents preference choices to users, propagates withdrawals across systems, and keeps an auditable record of who consented to what and when.
DataSafeguard captures consent, propagates withdrawals, and enforces those choices where it matters: gating which data is allowed to reach a model. See consent management or read how the EU AI Act and GDPR apply together.