The mandatory legal criteria, predominantly defined by GDPR and ePrivacy Directive, that must be met for user consent to be considered valid and lawful.

These requirements dictate the technical design of the consent flow: consent must be Freely Given, Specific, Informed, and Unambiguous (Art. 7).

Operationalising this requires the implementation of Category-based Script Blocking and the deployment of a clear GDPR Cookie Popup.

Compliance risk is high, as non-compliance can be proven if the default state is ‘opt-in’ for non-essential trackers. These requirements form the basis for CMPs like Seers.ai’s logic.