The GDPR does not only recognise the legal ground of consent. However, many of its interpreters still see consent as a "cornerstone of data protection law" and a "genuine expression of the right to informational self-determination". For this reason, many - at least in legal practice - continue to assume a "primacy of consent".

In fact, consent has become a formalised act ("mechanical proceduralism"), especially in Internet context, on social networks, on platforms and in the Internet of Things. Consent creates the illusion of control for the data subject ("simulation of sovereignty"). When it becomes clear that this control does not exist to the extent expected, this leads to disappointment among data subjects.

Through consent, controllers are able to pass on their responsibility to users in page-long data protection declarations and general terms and conditions. Data subjects find themselves in a "take it or leave it" situation. The effect of consent is thus based more on legal fiction than on free will.

In addition, established and large companies tend to benefit from the consent requirement because they obtain consent more quickly and easily than newcomers and SMEs. The latter are thus even strengthened compared to the former.

In digital life, individuals can in any case no longer escape data processing without massive personal losses. Individuals should therefore be released from the need to make permanent individual decisions about whether they want data processing or not. Similar to the purchase of a car or a medicine, it should be clear from the perspective of the data subject that services and processing operations placed on the market entail risks and are subject to certain regulatory requirements, without consent therefore being required every time.

The GDPR does not contain any remedy for these disadvantages of the legal institution of consent.