Written by: Haim Ravia, Dotan Hammer
Israel’s Privacy Protection Authority (PPA) has published its position paper on the principle of consent under Israeli privacy law. The paper, which builds upon a draft opinion published for public consultation in February 2025, clarifies how consent applies in the digital age and outlines the PPA’s interpretations that will guide its enforcement efforts under Amendment 13 to the Privacy Protection Law.
The position paper introduces a significant shift in the PPA’s approach to consent. The Authority now makes clear that existing mechanisms for obtaining consent, such as pre-marked checkboxes, general notices about data use, or inferring tacit consent from a user’s use of a product or service, may be considered “suspicious consent.” In such cases, the data controller will bear the burden of proving that data subjects gave informed and reasoned consent after fully understanding the purposes of data collection and use.
Among the key changes, the PPA limits reliance on tacit or implied consent. Inaction or the absence of objection by a customer or user will generally not be considered valid consent. There is a clear preference for opt-in mechanisms, particularly when sensitive information is collected or when inherent power disparities exist between the parties, such as between employers and employees or essential service providers and consumers.
The paper also emphasizes that data subjects must be informed of the implications of the use of their personal data, understand the purposes for which their data is collected and used, the scope of data processing, the risks involved, and their right to refuse. Consent must be specific rather than sweeping, and controllers must obtain explicit and separate consent for each use of personal data that exceeds the primary purpose for which it was originally collected.
The Authority also addresses consent in the context of power imbalances, stating that in situations involving material disparities, the party requesting consent must take active measures to ensure that consent is truly informed and freely given. The position paper carries particular significance given that consent remains the primary legal basis for data processing under Israeli privacy law.
Click here to read the Israeli Privacy Protection Authority’s Position Paper on Valid Consent (in Hebrew).
