GDPR Article 4(11): any freely given, specific, informed and unambiguous indication of the data subject’s wishes, given by a clear affirmative action, with Article 7 requiring the controller to demonstrate it was given and withdrawal to be as easy as giving it. It is one of several lawful bases for processing and, notably, cannot cure an otherwise unlawful practice such as Behavioural advertising targeted at a known minor.