Where consent actually gets collected

The Act does not describe screens. It describes a purpose, a notice attached to the request for consent, a consent limited under Sec. 6(1) to the personal data necessary for that purpose, and a withdrawal that has to be as easy as consenting was and has to reach the Data Processors already holding the data. A page in this section takes one place where personal data actually enters a business and works out what those four requirements mean there.

Marketing and communications is the first, and the flow where the gap is widest. Most marketing permission was collected inside account creation, alongside terms acceptance, so it is one consent standing in for several purposes — and Sec. 6(1) limits a consent to what is necessary for the specified purpose it was given for. Unbundling it is what lets someone stop promotional email without losing transactional notification, which is usually what they were asking for. The page then follows a withdrawal to the three places it has to arrive: the sending systems, the advertising audiences built from the same list, and the warehouse copy that rebuilds the segment on its next run. Sec. 6(6) is discharged when processing stops, not when a flag is set.

What the notice itself must contain is in Learn; how a decision is recorded so it can be produced later is in Features. Where the same flow looks different in one sector, industries carries it; where the question is whether a platform built for another statute can do this at all, that is Compare.