§ 33 NDSG
Consent
(1)Where the processing of personal data may, pursuant to a legal provision, be based on consent, the controller must be able to demonstrate the consent of the data subject.
(2)Where the consent of the data subject is given by a written declaration which also concerns other matters, the request for consent must be presented in an intelligible and easily accessible form, using clear and plain language, so that it is clearly distinguishable from the other matters in the external appearance of the declaration.
(3)1The data subject shall have the right to withdraw his or her consent at any time. 2The withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal. 3The data subject shall be informed thereof prior to giving consent.
(4)1Consent shall be valid only if it is based on the free decision of the data subject. 2In assessing whether consent was freely given, the circumstances of its provision must be taken into account. 3The data subject shall be informed of the intended purpose of the processing. 4Where this is required by the circumstances of the individual case or where the data subject so requests, he or she shall also be informed of the consequences of refusing consent.
(5)Where special categories of personal data are processed, the consent must expressly refer to those data.