Privacy Notice and Consent

A privacy notice explains data handling; consent records a person's agreement to a specified use where that mechanism applies. Showing a notice does not itself establish consent, and consent is not the only possible legal basis for processing. Requirements depend on the applicable rules.

Connect the choice to the stated use

Agreeing to delivery updates should not silently authorize using support transcripts for unrelated model training. Record the relevant purpose, scope, notice version, and choice event. A boolean called consent can hide which use was actually agreed.

The European Commission's guidance illustrates purpose-specific consent in the EU; it should not be treated as a universal statement of every jurisdiction's rules.

A changed choice must change processing

Determine what withdrawal or another preference change requires, then propagate it to relevant systems and recipients. Some independently justified retention may remain, so communicate the actual outcome and applicable limits. A visible control that changes only the interface while downstream processing continues does not implement the promised choice.

Reference: European Commission: Legal grounds for processing data.