# Consent and Preference Management in CIAM: A GDPR-Ready Guide Source: https://startwithidentity.com/articles/ciam-consent-preference-management/ Last updated: 2026-10-16 License: content by Start with Identity. Cite the source URL. --- Consent and preference management in CIAM means capturing each customer's choices about how their data is used, storing them on the identity record with evidence, and enforcing them in every system that touches the data. When consent lives in the [customer identity](https://startwithidentity.com/guides/fundamentals/what-is-ciam/) platform rather than in a marketing tool, one answer travels with the customer across apps, channels, and regions. For the general concept, see [consent management](https://startwithidentity.com/glossary/consent-management/). ## What the law actually requires The [GDPR](https://startwithidentity.com/glossary/gdpr/) sets the bar most programs design to. Article 4(11) defines consent as a "freely given, specific, informed and unambiguous" indication of the data subject's wishes. [Article 7](https://eur-lex.europa.eu/eli/reg/2016/679/oj) adds four conditions: 1. The controller must be able to **demonstrate** that consent was given. 2. A consent request inside a document covering other matters must be **clearly distinguishable**, in clear and plain language. 3. The data subject can **withdraw at any time**, and "it shall be as easy to withdraw as to give consent." 4. Consent is not freely given if a service is made **conditional** on consent to processing it does not need. Recital 32 of the same regulation is the one product teams quote: consent requires a clear affirmative act, and "silence, pre-ticked boxes or inactivity should not therefore constitute consent." Where processing has several purposes, consent should be given for all of them. The Court of Justice applied this in Planet49 (C-673/17, 1 October 2019), ruling a pre-ticked checkbox invalid. Article 8 sets 16 as the age for a child's own consent to online services, which member states may lower to no less than 13. The [GDPR regulation page](https://startwithidentity.com/regulations/european-union/gdpr/) and the [GDPR for identity systems](https://startwithidentity.com/guides/compliance/gdpr-for-identity-systems/) guide cover the wider obligations. Consent is also only one of six lawful bases in Article 6. Login, fraud prevention, and order fulfilment usually run on contract or legitimate interests, not consent. Asking for consent you do not need, then being unable to honor its withdrawal, is a common self-inflicted problem. The [CCPA, as amended by the CPRA](https://startwithidentity.com/regulations/united-states/ccpa-cpra/), works mostly the other way round. [California Civil Code section 1798.120](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV§ionNum=1798.120.) gives consumers the right to opt out of the sale or sharing of their personal information, and requires opt-in consent for consumers under 16. The [CPPA regulations](https://cppa.ca.gov/regulations/) require businesses to treat opt-out preference signals such as Global Privacy Control as valid requests, and the statute says agreement obtained through dark patterns is not consent. ## Consent versus preferences Keep the two concepts distinct in the data model. **Consent** is a legal permission for a purpose (email marketing, analytics, sharing with partners) and needs evidence. **Preferences** are customer choices about experience (channels, topics, frequency, language) that can be edited freely. A single "marketing opt-in" boolean conflates them and fails both: it cannot prove what the customer agreed to, and it cannot express "product news by email, monthly." ## The consent data model Each consent record should hold the subject identifier, the purpose, the version of the notice text shown, the timestamp, the capture point (signup form, preference center, API, support agent), the status, and the jurisdiction. Store it as an append-only history, not a field you overwrite, because Article 7(1) asks you to demonstrate past consent, not just report current state. When a purpose's notice text changes materially, the version change tells you which customers need to be asked again. ## Capture without dark patterns - Unticked boxes, one per purpose, separate from acceptance of the terms of service. - Accept and decline options with equal prominence. - Plain-language purpose text at the point of capture, linked to the full notice. - Social login scopes are not consent to marketing. The identity provider's consent screen authorizes data release to you, not your use of it. ## Enforce it downstream A consent record nobody reads is evidence against you. Expose current consent state in token claims or the profile API so applications can check it at request time, and publish grant and withdrawal events to marketing, analytics, and customer data platforms with a defined propagation window. Build the preference center on the same records, behind login, and when a signed-in browser sends a Global Privacy Control signal, apply it to the account, not just the session. ## Platforms and tools Consent depth varies widely across CIAM platforms. [cidaas](https://startwithidentity.com/vendors/ciam/cidaas/) builds consent management and EU data residency into the platform, [SAP Customer Data Cloud](https://startwithidentity.com/vendors/ciam/sap-customer-data-cloud/) handles preference and consent capture at the granularity large regulated B2C brands need, and [Strivacity](https://startwithidentity.com/vendors/ciam/strivacity/) includes consent in its no-code journeys. Cookie banners are usually a separate consent management platform; see [top customer consent management platforms](https://startwithidentity.com/articles/top-5-customer-consent-management-platforms/) for that layer. To compare CIAM options, start with the [best compliant CIAM platforms](https://startwithidentity.com/rankings/best-compliant-ciam-platforms/) and [best CIAM platforms](https://startwithidentity.com/rankings/best-ciam-platforms/) rankings, test consent export and withdrawal propagation using the [how to evaluate CIAM](https://startwithidentity.com/guides/buyer-guides/how-to-evaluate-ciam/) guide, and check capability coverage in [Deepak Gupta's CIAM Compass](https://guptadeepak.com/ciam-compass/). The test of a consent system is simple: pick any customer and produce, in minutes, what they agreed to, when, on which wording, and proof that every system honored their last change.