Is all consent created equal? How the different privacy statutes treat the standard for consent.

Consent plays a role in almost all modern privacy statutes. In some privacy statutes, like the GDPR, it can function as one of many lawful purposes to process data. In other privacy statutes, like the VCDPA and the CPA, it is mandated for certain types of data processing (e.g., sensitive category data processing). How consent is defined, however, differs between and among statutory and regulatory schemes. The following provides a side-by-side comparison of how some of the main data privacy statutes define the term:

	Definition of Consent
Europe GDPR	“ . . . any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.”[4]
California CCPA De Facto Sensitive As Given Enhanced Litigation Rights[1]	The CCPA does not define the term “consent.”[5]
California CPRA Defined as Sensitive Personal Information[2]	“ . . . any freely given, specific, informed, and unambiguous indication of the consumer’s wishes by which the consumer . . . including by a statement or by a clear affirmative action, signifies agreement to the processing of personal information relating to the consumer for a narrowly defined particular purpose.”[6]
Virginia VCDPA[3]	“. . . a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer. Consent may include a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.”[7]
Colorado CPA	“. . . a clear, affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement, such as by a written statement, including by electronic means, or other clear, affirmative action by which the consumer signifies agreement to the processing of personal data.”[8]