CIPM Consent Management Flashcards

What is the fundamental difference between opt-in and opt-out consent models?

Answer: Opt-in requires active agreement before processing; opt-out assumes consent exists unless the individual declines

Opt-in models require individuals to actively indicate consent before processing occurs, while opt-out models assume consent exists unless the individual takes action to decline.

Under GDPR, how must organizations handle a request to withdraw consent?

Answer: Make withdrawal as easy as giving consent was

GDPR Article 7(3) requires that withdrawing consent be as easy as giving it, ensuring individuals can effectively revoke consent without undue burden.

Which CAN-SPAM Act requirement relates most directly to email consent management?

Answer: Recipients must be given a clear and conspicuous way to opt out of future emails

The CAN-SPAM Act requires commercial email senders to include a clear opt-out mechanism and honor opt-out requests within 10 business days.

What does 'granular consent' mean in the context of privacy management?

Answer: Providing separate consent choices for each distinct processing purpose

Granular consent means individuals are offered separate choices for distinct processing purposes rather than one bundled consent for all activities.

Under GDPR, what determines how long a previously obtained consent record remains valid?

Answer: Consent remains valid until the purpose is fulfilled or the individual withdraws it

Consent remains valid only as long as the processing purpose exists and the individual has not withdrawn it; organizations should periodically review consent records.

What is a 'consent receipt' in privacy management practice?

Answer: A record provided to individuals confirming the terms of their consent

A consent receipt is a record given to individuals at the time of consent documenting what they agreed to, supporting transparency, accountability, and auditability.