GDPR consent
Permission obtained before personal data is recorded, one of the lawful bases the GDPR requires for processing, and a question about data rather than about the redirect.
Updated August 14, 2026
Under the GDPR, consent is one of the lawful bases on which personal data may be processed, and the most demanding to obtain properly. It has to be freely given, specific, informed and unambiguous, expressed by a clear affirmative act, recorded so it can be demonstrated later, and as easy to withdraw as it was to give. Pre-ticked boxes, silence and buried clauses do not qualify.
Order matters as much as wording. Consent belongs before the first record is written, not after: anything gathered while a banner is still waiting for an answer has already been gathered. Consent is also not the only basis available, and choosing which one applies is the responsibility of whoever decides why the data is collected — for link measurement, usually the party publishing the link rather than the tool serving it.
The redirect itself is delivery of an address. What consent actually attaches to is the record kept about the visitor along the way, which privacy modes settle at the moment of writing rather than at the moment of reporting.