From GDPR to the Bedroom: What Makes Consent 'Valid'? 6 Legal Lessons for Intimacy
In the digital age, the word 'consent' is everywhere. From clicking website cookie banners to granting app permissions, to the very concept of a 'digital consent form for consensual sex' that our platform advocates—but what exactly makes consent legally 'valid'?
Interestingly, major recent court cases in the EU (under GDPR) and Canada (under PIPEDA) regarding data privacy provide a cutting-edge framework for thinking about this. These courtroom battles over billions of users' data offer unexpected insights for the dynamics between two people.
Lesson 1: Consent Must Be 'Autonomous', Not Coerced
In a landmark UK case, RTM v. Sky Betting & Gaming (2025), a user with a gambling addiction sued a platform, arguing his consent to tracking ads was invalid. The High Court introduced a novel idea: valid consent must be 'autonomous'. This means the individual must be in a state to make a free and uncoerced decision.
If a person's judgment is impaired by addiction, substances, or extreme vulnerability, the consent given might be void from the start. Applying this to intimacy: consent given under the influence of alcohol/drugs, or under threat or pressure, is legally very weak, or even non-existent.
Lesson 2: Consent Must Be 'Specific', Not Blanket Authorization
The Federal Court of Appeal of Canada, in Canada (Privacy Commissioner) v. Facebook, Inc. (2024), addressed the Cambridge Analytica scandal. The court made it clear that burying a clause about 'possibly sharing data with third parties' within thousands of words of terms of service is not valid, specific consent. Consent must be 'specific'; users must give explicit permission for each distinct purpose of data processing.
In the context of intimacy, this means 'I consent to sex' does not equal 'I consent to all forms of sex.' Just like the professor in our first case who clearly defined 'no ejaculation inside,' valid consent requires specificity. A well-designed consent form helps partners confirm each other's intentions item by item.
Lesson 3: Consent Must Be 'Informed', Based on Sufficient Information
In the same Facebook case, the court emphasized the importance of being 'informed'. Even if a user clicks 'agree,' if the information provided was vague, misleading, or presented so obscurely that a 'reasonable person' couldn't truly understand what they were agreeing to, the consent is invalid.
In intimate relationships, being informed means full disclosure. This includes honestly sharing one's sexual health status (e.g., STIs), expectations regarding contraception, and any other crucial facts that might influence the other person's decision. Withholding key information (like knowing you have an STI) could invalidate the other person's consent due to lack of information.
Lesson 4: Consent Must Be 'Unambiguous', Not Implied or Presumed
The Quebec Court of Appeal in A.B. v. Miller (2025) reminds us that consent cannot be presumed. Even if a person accepts money, it doesn't mean they implicitly agreed to all terms in a legal document. The court stressed that implicit consent must stem from a clear intention, not be vague or ambiguous.
Applying this standard to intimacy: 'Not saying no' does not mean yes. Silence does not mean consent. Dressing sexy, going home with someone, or even accepting a gift cannot be presumed as consent for any form of sexual activity. Valid, verifiable consent requires an active, unambiguous expression.
Lesson 5: Power Imbalances Erode the Validity of Consent
A recent EU General Court ruling (Case T-319/24), reviewing Meta's 'consent or pay' model, reaffirmed the impact of power imbalances on consent. If one party is in a dominant position, the so-called 'free choice' of the weaker party might be an illusion.
This is highly relevant in intimate relationships. Between a boss and subordinate, teacher and student, landlord and tenant, or partners with a vast economic disparity, the consent given by the weaker party must be scrutinized more strictly to ensure it wasn't a compromise made out of fear of losing a job, grades, or shelter.
Lesson 6: Consent Can Be Withdrawn, and Withdrawal Must Be Respected
While GDPR cases primarily focus on giving consent, a core principle—that consent is an ongoing process—applies equally to interpersonal interactions. At any time, anyone has the right to withdraw consent. Once withdrawn, the other party must stop immediately.
As the old Wyoming case Hamburg v. Hansen (1984) highlights as a baseline: a contract exchanging property for sexual favors is void as against public policy. This reminds us that sexual autonomy is inherent and inalienable. It cannot be the subject of a commercial transaction and cannot be permanently sold via a contract.
Conclusion: Let Consent Return to Communication
These seemingly strict legal principles all point to the same core idea: respect. Respect for the other person as an independent individual, respect for their boundaries and wishes, and a willingness to take the time to understand and confirm those boundaries.
A digital consent form is just a tool, a framework to help us have this crucial conversation. It cannot replace genuine communication, but it can help us be clearer, building relationships on a stronger foundation of trust.