Consent Expression

https://publicschema.org/vocab/consent-expression

draft

How the data subject indicated their agreement or non-objection. Orthogonal to collection-medium (paper, electronic, verbal, mixed), which describes the physical or digital channel used. Orthogonal to personal_data_categories, which describes what data is being processed. A biometric expression (opt-in-biometric) means the subject used a biometric gesture as their signature; it does not imply that biometric data is being processed as subject matter. Whether biometric data is being processed is expressed via personal_data_categories.

CSV JSON-LD

Values

Code Label Standard code Definition
opt_in_explicit Explicit opt-in The data subject made a clear affirmative act, such as ticking a box, pressing a confirm button, or verbally stating agreement, with full awareness of what they were agreeing to. No ambiguity is permitted. The standard for opt-in where no signature or biometric is required.
opt_in_signed Signed opt-in The data subject signed a consent form, either physically on paper or with a digital signature. The signature is the primary evidence of agreement. Signed consent is typically used when legal requirements demand a written record, such as for the processing of special-category data or for minor guardianship consent.
opt_in_witnessed Witnessed opt-in The data subject indicated agreement verbally or by gesture and one or more witnesses were present and recorded. Used when the data subject cannot or does not write. Programs using this expression must populate witnessed_by. Witnessing requirements (minimum number of witnesses, witness eligibility) are set by the program's operating procedures and applicable law, not by this schema.
opt_in_biometric Biometric opt-in Consent indicated by a biometric capture serving as the signature, for example a thumbprint on a paper form or on a tablet screen. This is the method of capturing consent (analogous to signing with a pen), not a decision to process biometric data as subject matter. Whether biometric data is being collected and stored for program purposes is a separate question expressed via personal_data_categories. A thumbprint used only as a consent signature does not, by itself, mean that biometric data is being processed under this consent record.
opt_out Opt-out The data subject was notified of the processing and did not object within the given period or through the given mechanism. Opt-out processing is legitimate only where a legal basis other than consent exists (legal obligation, public interest). Programs using opt-out must ensure the notice clearly explains the processing and provides a genuine, easy mechanism for objection.
implied Implied Agreement is inferred from the data subject's behaviour or circumstances, without an explicit act of consent or formal notification of opt-out. Implied consent is legally thin and should be used only where specifically permitted by applicable law. Programs relying on implied consent should document the legal basis and the inference logic in legal_basis_reference.

Other references