Consent
Freely given, informed, and unambiguous agreement to data processing.
How the laws define this
Regulators consistently ground valid consent in a voluntary, informed, and unambiguous agreement given by an individual before or during specific activities, such as data processing, voice replication, or AI-driven evaluation. Despite this shared foundation, requirements diverge significantly regarding formal documentation and revocability. Frameworks like the Bill to protect dubbing actors from AI use, An act relating to regulating the use of artificial intelligence in the provision of mental health services, and the Wellness and Oversight for Psychological Resources Act explicitly demand written authorization—with the latter two also strictly mandating that consent be revocable and rejecting passive digital actions like hovering or accepting broad terms. Conversely, broader privacy and criminal measures—such as Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data and the Privacy and Personal Data Protection Bill—focus primarily on the freely given, informed nature of the agreement without universally requiring a written contract.
Synthesised from the 9 statutory definitions below. Each one is quoted in full, with its source.
How jurisdictions differ
What is distinctive in each definition, binding law in force first.
| Jurisdiction | Instrument | Status | What is distinctive |
|---|---|---|---|
| Illinois, United States | Illinois Artificial Intelligence Video Interview Act | In Force | Requires explicit agreement obtained prior to the video interview specifically for AI evaluation as described by the employer. |
| Rwanda | Law No. 058/2021 Relating to the Protection of Personal Data and Privacy | In Force | Adds requirements that consent must be documented and can be withdrawn. |
| Morocco | Law No. 09-08 on the Protection of Individuals with Regard to the Processing of Personal Data | In Force | Consent serves as a legal basis for processing personal data in situations where consent is required under the law. |
| Vermont, United States | An act relating to regulating the use of artificial intelligence in the provision of mental health services | In Force | Specifies that consent must be an explicit, affirmative act communicated in writing, emphasizing revocability in AI mental health contexts. |
| Maldives | Personal Data Protection Bill | Proposed | Adds requirements for mechanisms to obtain, record, and manage valid consent as a lawful basis for processing. |
| Mexico | Bill adding criminal sanction for AI‑generated intimate content without consent | Under Review | Limits consent to explicit approval for producing, altering, or sharing intimate sexual content, with lack thereof generating criminal liability. |
| Argentina | Bill 7225-D-2024 – Incorporation of Articles 128 bis and 131 bis into the Criminal Code on the Dissemination of AI-Generated Sexual Images | Under Review | Limits consent to voluntary, informed agreement for production, manipulation, publication, or distribution of intimate images, absence triggering criminal liability. |
| Illinois, United States | Wellness and Oversight for Psychological Resources Act | In Force | Specifies what does not constitute valid consent, such as general terms of use, hovering, or deceptive actions, and requires revocability. |
| Mexico | Bill to protect dubbing actors from AI use | Proposed | Requires prior, informed, and written authorization explicitly allowing AI replication or cloning of a performer's voice. |
What it triggers
- In Illinois, under the Artificial Intelligence Video Interview Act, employers must obtain explicit agreement prior to evaluating applicants with AI.source
- In Illinois, under the Wellness and Oversight for Psychological Resources Act, entities must obtain clear, explicit, affirmative written consent for actions covered by the Act.source
- In Rwanda, under Law No. 058/2021, consent must be documented as a basis for processing personal data.
- Under the proposed Mexico bill on AI-generated intimate content, lack of explicit approval generates criminal liability for production or sharing.source
Definitions (9)
An indication by a data subject that they agree to the processing of their personal data, which must be freely given, specific, informed, and unambiguous. The Bill requires mechanisms to obtain, record, and manage valid consent as a lawful basis for processing.
The explicit approval of the subject to produce, alter, or share intimate sexual content; lack of this approval is the central element generating criminal liability under the proposed paragraph.
Prior, informed and written authorization granted by the rights holder (e.g., the performer) that explicitly allows the replication, cloning or other uses of their voice by AI technologies; required for lawful AI-based replication or substitution under the proposed amendments.
An explicit indication by which a data subject, through a clear affirmative act, freely, specifically, informedly and unambiguously signifies agreement to the processing of their personal data for one or more specified purposes; consent must be documented and can be withdrawn.
Refers to a person's voluntary, informed agreement to the production, manipulation, publication, or distribution of intimate images or audiovisual material; the absence of such consent is a central element establishing criminal liability for non‑consensual AI‑generated sexual content involving adults.
An indication of the data subject's wishes that is freely given, specific, informed, and unambiguous, which serves as a legal basis for processing personal data in situations where consent is required under the law.
Explicit agreement obtained from an applicant, prior to the video interview, to be evaluated by an artificial intelligence program as described by the employer.
Meticulously defined as an explicit, affirmative act by an individual, communicated in writing, that demonstrates a voluntary, informed, and revocable agreement. This rigorous standard for consent is particularly vital when AI is involved in sensitive data handling or therapeutic interactions.
For the purposes of this Act, consent means a clear, explicit, affirmative act by an individual that unambiguously communicates their express, freely given, informed, voluntary, specific, and unambiguous written agreement. This includes written agreements provided by electronic means, and such consent must be revocable. Notably, the Act specifies what does not constitute valid consent, such as the acceptance of general or broad terms of use, hovering over digital content, or agreements obtained through deceptive actions.
Not to be confused with
Explicit consent emphasizes clear demonstrability and withdrawability, while this term's definitions vary in adding specifics like documentation or exclusions.
Informed consent focuses on receiving relevant information prior to agreement, whereas this term often requires the agreement to be explicit and documented.
Questions and answers
What makes consent invalid under Illinois psychological resources law?
Consent is invalid if obtained through general terms of use, hovering over content, or deceptive actions; it must be clear, explicit, and revocable.
Does consent need to be documented for personal data processing?
Yes, under Rwanda's data protection law, consent must be documented and can be withdrawn.
What is required for AI voice replication of performers in Mexico?
Prior, informed, and written authorization explicitly allowing the replication is required under the proposed bill.
Related Terms
Explicit Consent
Clearly demonstrable, specific and withdrawable consent....
Informed Consent
Voluntary agreement after receiving relevant information....
Sensitive Data
Data requiring stricter protection due to privacy risks....
Personal Data
Information relating to an identified or identifiable person....
notification duty
Point‑of‑collection obligation to inform data subjects....