Consent for non-essential processing collected via explicit opt-in
Why it matters
GDPR Art. 7 requires that consent be freely given, specific, and unambiguous — a pre-checked box for analytics or a default-on email marketing enrollment fails all three criteria. Under CCPA §1798.120, users must be able to opt out of data sale at any time. Enabling non-essential processing before consent is collected exposes the platform to enforcement under GDPR Art. 83 (fines up to 4% of global turnover) and CCPA §1798.150 (statutory damages). The eprivacy Directive Art. 5(3) independently requires opt-in for tracking cookies, making this a multi-jurisdiction risk.
Severity rationale
Critical because default-enabled non-essential processing violates GDPR Art. 7 and eprivacy Art. 5(3) simultaneously, with enforcement exposure in every EU jurisdiction.
Remediation
Gate every non-essential processing type behind an unchecked checkbox at signup and expose the same toggles in account settings. Persist consent decisions with timestamp and policy version — see ab-000724 for the audit log schema. Signup form example:
<label>
<input type="checkbox" name="analyticsOptIn" />
Help us improve by sending anonymous usage analytics
</label>
<label>
<input type="checkbox" name="recommendationsOptIn" />
Personalized content recommendations
</label>
Reject any server-side processing for unconsented types before the API call returns — checking consent in middleware rather than in business logic prevents bypasses.
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the Community Privacy & Controls Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- gdpr · Art. 7 — Conditions for consent
- gdpr · Art. 6 — Lawfulness of processing
- ccpa · §1798.120 — Right to opt-out of sale or sharing of personal information
- eprivacy · Art. 5(3) — Confidentiality of communications — consent for non-essential processing
- cwe · CWE-281 — Improper Preservation of Permissions
- gdpr · Art. 83 — General conditions for imposing administrative fines
- ccpa · §1798.150 — Personal Information Security Breaches — private right of action
Taxons
History
- 2026-04-18·v1.0.0·Initial import from community-privacy-controls·automated