What is the difference between consent and notice?

Three different things

Notice — you tell someone what you intend to do. A privacy policy is notice. So is a banner saying data is collected. Notice requires no response and produces no record of agreement.

Consent — the person affirmatively agrees. It requires an action they chose to take: ticking an unchecked box, clicking accept, signing.

Permission — a looser, everyday word that means neither reliably, and is worth avoiding in any document that might be scrutinised.

Opt-in and opt-out

	Opt-in	Opt-out
Default state	Nothing happens	It happens
Person’s action	Chooses to allow	Must act to stop it
Record produced	Positive act, timestamped	Often none until they object
Used for	Marketing calls and texts, sensitive data, GDPR	Sale of data under most US state laws

A pre-checked box is opt-out wearing an opt-in costume. It looks like consent in a screenshot and generally does not hold up as one.

Where implied consent still lives

Implied consent — inferred from conduct rather than stated — remains valid in narrow circumstances. Giving a pharmacy your phone number so they can tell you a prescription is ready implies consent to that call.

It does not stretch. The same number does not imply consent to marketing calls, or to being shared with a partner, or to text messages about unrelated products. The implication extends only as far as the obvious purpose.

Why organizations get this wrong

The failure is nearly always the same shape:

1. A privacy policy is published — that is notice.
2. A form is built with a checkbox — that looks like consent.
3. The checkbox is pre-ticked, or bundled with terms acceptance, or the disclosure is vague — so it is neither.
4. The record kept says consent: true — which describes step 2, not steps 1 and 3.

Then something is contested and the question becomes what the person actually agreed to, at which point the answer is a policy nobody read and a checkbox nobody had to think about.

The practical version

If you need consent, make it look like consent:

• Unchecked by default. Always.
• Separate from terms acceptance. Bundling makes both weaker.
• Specific about who and what. “Marketing partners” is not who.
• Recorded with what was shown, not just that it was submitted. See proving consent.
• Revocable, and honored when revoked — with a record that you honored it.

If you only need notice, say so plainly rather than dressing it up as consent. A clearly-labeled notice is a defensible position. A weak consent record is not, and it invites the argument that you knew consent was required.

---

General information, not legal advice.