Skip to content
Notice & Consent

REALconsent: consent that can be shown to have happened

A click recorded after someone has already been identified is a system permission, not evidence of an informed choice. REALconsent sets out what has to be in place for consent to be real, and provable later.

TCIEG

TCIEG

— 1 min read
Share

In many online services the individual is identified before the controller is disclosed, before the purpose is stated, and before the legal basis can be checked. A click recorded at that point is a system permission. It is weak evidence that a person understood and agreed.

Four things have to be in place.

  1. Controller first. The individual can see who is asking, and under what authority, before anything about them is collected.
  2. Notice on record. The exact version of the notice that was shown can be checked later.
  3. Receipt kept. The person keeps their own evidence of what they agreed to, and does not have to identify themselves to get it.
  4. Changes logged. Later changes, including withdrawal, are recorded so the current state can be shown at any time.

REALconsent is TCIEG’s public framework for explaining and testing whether an online consent interaction produces evidence of an informed, specific, freely given and withdrawable human choice. It separates the person’s consent statement from the permissions a system manages after that statement.

The framework follows the Operational Transparency Stack. ISO/IEC 29100 supplies the privacy principles. ISO/IEC 29184 addresses the notice and consent interaction. ISO/IEC TS 27560:2023 structures the consent record and receipt. The Kantara ANCR extension anchors that evidence to the controller, the notice version, the presentation event and later changes.

Where it stands

TCIEG is developing the assessment method, implementation guidance and participation model. Until those are formally published, REALconsent is a framework under development, not a certification or conformity mark.

To discuss it, write to info@tcieg.org.

Licensed under Creative Commons Attribution 4.0 International (CC BY 4.0). Machine reuse is additionally subject to the 0PN Machine Reuse Terms 1.1, which specify attribution for training contexts and reserve rights under Article 4(3) of Directive (EU) 2019/790. The Terms do not modify or restrict the CC BY 4.0 grant. 0pn-mrt-1.1

Read more