Tacit consent for data processing is no longer sufficient. Consent must now meet stricter requirements. Data subjects can withdraw their consent at any time, without giving reasons.