Which two options are required by GDPR when requesting marketing consent from customers? (Choose two.)

The General Data Protection Regulation (GDPR) establishes strict rules for obtaining consent. Consent must be demonstrable, meaning the data controller (the merchant) must be able to prove that valid consent was obtained. This requires keeping detailed records of who consented, when, how, and to what specific processing they agreed. Furthermore, consent must be freely given and specific. This means it cannot be bundled with other, non-essential items like general terms and conditions. Forcing a user to accept marketing to use a service is not considered freely given consent.

A. Opt-in boxes must be pre-ticked. This is explicitly forbidden by GDPR. Consent requires a clear, affirmative action; pre-ticked boxes rely on inaction and are not valid forms of consent.
D. Multiple marketing consents must be done with a single opt-in. This is incorrect. GDPR requires consent to be specific and granular. If there are different types of marketing (e.g., email, SMS), separate consent should be obtained for each.

1. Official Vendor Documentation (Adobe):

Adobe Commerce User Guide, "General Data Protection Regulation". This document outlines key GDPR principles for merchants. It states, "You must keep records of consent," which supports option B. It also specifies, "Consent should be unbundled from other terms and conditions," directly supporting option C. The guide further clarifies that "Implicit consent is no longer adequate" and "pre-checked opt-in boxes are invalid," which refutes option A.

Reference: Adobe Experience League. (n.d.). General Data Protection Regulation. Adobe Commerce User Guide. Retrieved from https://experienceleague.adobe.com/docs/commerce-admin/stores-sales/site-privacy/privacy-gdpr.html?lang=en

2. Official Legal Text (European Union):

Regulation (EU) 2016/679 (General Data Protection Regulation), Article 7, "Conditions for consent".

Paragraph 1 states: "the controller shall be able to demonstrate that the data subject has consented to processing of his or her personal data." This is the legal basis for option B.

Paragraph 2 states: "If the data subject’s consent is given in the context of a written declaration which also concerns other matters, the request for consent shall be presented in a manner which is clearly distinguishable from the other matters..." This is the legal basis for option C.

Reference: Official Journal of the European Union. (2016, April 27). Regulation (EU) 2016/679 of the European Parliament and of the Council. L 119/1. Article 7, Paragraphs 1 & 2.