Most of what the legal person agrees to on your behalf, it agreed to before you could read. The rest it agreed to in language nobody reads. This lesson is about what to do with that.
There are three flavours of consent at work in your file, and they are not equally easy to deal with. Telling them apart is the whole game.
Implied consent
Implied consent is consent the system reads into your behaviour. You walk into a shop, you imply a willingness to pay for what you take. You drive on the road, you imply acceptance of the Highway Code. You open a bank account, you imply acceptance of the bank's terms. None of this is sinister. It is a sensible legal shortcut for everyday life. The problem is that the same logic gets stretched to cover things you did not actually agree to. Live at this address, imply acceptance of council services and the council tax that funds them. Hold an NHS number, imply acceptance of data sharing with whichever new database gets stood up next.
You can rarely undo implied consent at the source. The shortcut is too useful to the system to be surrendered. What you can do is make the implied consent visible and contest the specific extensions of it that overreach.
Deemed consent
Deemed consent is consent the system manufactures by your silence. A bank writes to say their terms are changing on 1 March, and unless you object in writing before that date you are deemed to have accepted. A council writes to say it intends to apply for a liability order unless you respond within 14 days. The clock runs. The deadline passes. The consent is now legally on file.
Deemed consent is the timer attack you saw in the previous lesson, dressed up as agreement. The defence is the same: respect the clock. Open every brown envelope. Note every deadline. Respond, even if only to say "I do not consent and require this matter be set out in writing for my consideration." Silence is the opening the system was waiting for.
Express consent (the kind you can withdraw)
Express consent is a positive, recorded "yes" you gave at some point. The marketing tickbox at the bottom of an account form. The data-processing agreement on a website. The consent for your child's photo on the school newsletter. These are the easiest consents to remove, because the law that created them, in the UK that is mostly UK GDPR and the Data Protection Act 2018, also created a clean route to withdraw them.
This is the category to start with. It teaches you the move without the stakes.
A worked example: withdrawing marketing consent end to end
Pick a single bank, retailer, or charity that emails you. The brief is to remove yourself from their marketing entirely, not via the unsubscribe link at the bottom of one email, but properly, in writing, on file.
The letter. Two short paragraphs. Dated. Sent recorded delivery to their registered office (Companies House for the address) and CC'd to their data protection officer (their privacy notice will name one).
Dear Sir or Madam, Re: Account/customer reference [number] I am writing to withdraw, with effect from receipt of this letter, all consent previously given for the processing of my personal data for direct marketing purposes, in any channel, by yourselves or any third party acting on your behalf. This includes email, SMS, post, and telephone marketing. I am exercising my rights under Article 21 of the UK GDPR. Please confirm in writing within 30 days that this instruction has been actioned and that my details have been removed from all marketing lists. Yours faithfully, [autograph], a living man/woman
What happens. Within a week or two, an automated acknowledgement. Within 30 days, a confirmation that you have been suppressed. If marketing arrives after that confirmation, you have a clean breach to escalate to the ICO.
Why it teaches the move. You sent something dated. You cited the specific authority. You asked for written confirmation within a stated period. You kept a copy. That is the shape of every more serious withdrawal you will write later. The marketing one is the practice run with no downside.
What you cannot withdraw unilaterally
Be honest with yourself. Some consents are baked into a relationship you have not yet ended. You cannot withdraw consent to the bank's processing of your data while keeping the account open, because the processing is necessary to provide the service. You cannot withdraw consent to HMRC's processing while still in PAYE employment, because the employer has its own statutory obligation to report. The right move with these is not withdrawal; it is changing the underlying relationship, which is what the practical half of this course is about.
The clean rule: if the processing is genuinely necessary to deliver something you still want, withdrawal of consent will not work. If the processing is an extra, attached to the relationship for the system's convenience or revenue, withdrawal will work.
Hold the line
The first marketing-consent letter you send will feel disproportionate for what it does. Two paragraphs to stop one bank's emails. Then the second one feels routine. Then the third. By the time you are writing the more substantial conditional acceptance you will meet in module 4, the format and the posture are already familiar.
Start with the smallest, lowest-stakes consent in your life. Get the first written confirmation back. Put it in the folder you will build later. The mask cannot hand back what you never gave it. But it can release what you withdraw, in writing, on file, when the law you are using actually applies.