...
“Freely given” means exactly what it says. For example, you can’t force your customers to give consent by doing trickery such as giving them checkboxes saying “I accept the terms & conditions and want you to send me advertisements” and if they don’t check it, they can’t use your services.
“Specific” means that you have to ask for each consent specifically and separately. You need one checkbox per each processing purpose you’re asking consent for.
“Informed” means that you need to explain in a clear and easily understandable way what the data subject is consenting to.
“Unambiguous” basically means “clear” again. Consent has to be asked separately from the presentation of other information.
“Clear affirmative action” means that the data subject has to do something specific to show that they consent to something. This means that consent checkboxes may not be pre-ticked.
Processing sensitive data needs explicit consent.
Explicit consent is also required for transferring personal data outside of EEA without the adequacy decision (GDPR Art. 45), appropriate safeguards (approved codes of conduct/binding corporate rules, approved certification mechanism – see Art. 46) or approved corporate rules.
...