What makes consent valid, when express consent is required, and how to withdraw consent.
This page provides legal information, not legal advice. Consult a qualified privacy lawyer or CIPP/C-accredited privacy professional before taking action on access requests, breach response, complaints to a Privacy Commissioner, or Federal Court applications.
Last verified: September 2026
TL;DR
Consent must be meaningful, which means informed, specific, and given in a way that gives you a real choice. Sensitive information generally requires express (opt-in) consent. You can withdraw consent at any time subject to legal or contractual restrictions.
What makes consent meaningful
OPC guidance sets out key elements:
You know what personal information is collected.
You know with whom it is shared.
You know the purposes of the collection, use, and disclosure.
You know the risks of harm and other consequences.
Express vs. implied consent
Express consent is required for sensitive information (health, financial, biometric), secondary uses you would not reasonably expect, and certain high-risk activities.
Implied consent may be enough for routine activities that you would reasonably expect when you engage with an organization.
Withdrawing consent
You can withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. Some information (e.g., transaction records for tax purposes) must still be retained by law.