Consent
LOW MODERATE HIGHRequirements NIST SOURCE
Implement [tools or mechanisms] for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals’ informed decision-making.
Discussion (NIST Supplemental Guidance)
Consent allows individuals to participate in making decisions about the processing of their information and transfers some of the risk that arises from the processing of personally identifiable information from the organization to an individual. Consent may be required by applicable laws, executive orders, directives, regulations, policies, standards, or guidelines. Otherwise, when selecting consent as a control, organizations consider whether individuals can be reasonably expected to understand and accept the privacy risks that arise from their authorization. Organizations consider whether other controls may more effectively mitigate privacy risk either alone or in conjunction with consent. Organizations also consider any demographic or contextual factors that may influence the understanding or behavior of individuals with respect to the processing carried out by the system or organization. When soliciting consent from individuals, organizations consider the appropriate mechanism for obtaining consent, including the type of consent (e.g., opt-in, opt-out), how to properly authenticate and identity proof individuals and how to obtain consent through electronic means. In addition, organizations consider providing a mechanism for individuals to revoke consent once it has been provided, as appropriate. Finally, organizations consider usability factors to help individuals understand the risks being accepted when providing consent, including the use of plain language and avoiding technical jargon.
Enhancements NIST SOURCE
PT-4(1) Tailored Consent LOW MODERATE HIGH
Provide [mechanisms] to allow individuals to tailor processing permissions to selected elements of personally identifiable information.
Discussion
While some processing may be necessary for the basic functionality of the product or service, other processing may not. In these circumstances, organizations allow individuals to select how specific personally identifiable information elements may be processed. More tailored consent may help reduce privacy risk, increase individual satisfaction, and avoid adverse behaviors, such as abandonment of the product or service.
PT-4(2) Just-in-time Consent LOW MODERATE HIGH
Present [consent mechanisms] to individuals at [frequency] and in conjunction with [personally identifiable information processing].
Discussion
Just-in-time consent enables individuals to participate in how their personally identifiable information is being processed at the time or in conjunction with specific types of data processing when such participation may be most useful to the individual. Individual assumptions about how personally identifiable information is being processed might not be accurate or reliable if time has passed since the individual last gave consent or the type of processing creates significant privacy risk. Organizations use discretion to determine when to use just-in-time consent and may use supporting information on demographics, focus groups, or surveys to learn more about individuals’ privacy interests and concerns.
PT-4(3) Revocation LOW MODERATE HIGH
Implement [tools or mechanisms] for individuals to revoke consent to the processing of their personally identifiable information.
Discussion
Revocation of consent enables individuals to exercise control over their initial consent decision when circumstances change. Organizations consider usability factors in enabling easy-to-use revocation capabilities.
Implementation Guidance
Original engineering commentary written for this explorer — not NIST source text and not authoritative guidance.
No engineering interpretation has been authored for PT-4 yet. This section is architected to receive it — see the Requirements and Assessment sections above for the authoritative NIST source content in the meantime.
Assessment
Assessment Objectives
- the tools or mechanisms to be implemented for individuals to consent to the processing of their personally identifiable information are defined;
- the <PT-04_ODP tools or mechanisms> are implemented for individuals to consent to the processing of their personally identifiable information prior to its collection that facilitate individuals� informed decision-making.
Examine
[SELECT FROM: Personally identifiable information processing and transparency policy and procedures; consent policies and procedures; consent tools and mechanisms; consent presentation or display (user interface); evidence of individuals� consent; privacy plan; other relevant documents or records].
Interview
[SELECT FROM: Organizational personnel with personally identifiable information processing and transparency responsibilities; organizational personnel with information security and privacy responsibilities].
Test
[SELECT FROM: Organizational processes for the collection of personally identifiable information; consent tools or mechanisms for users to authorize the processing of their personally identifiable information; mechanisms implementing consent].
STIGs & CCIs
No STIG checks or CCI mappings are currently loaded for PT-4. This section is architected to display, per product: STIG ID, Finding ID, Severity, Title, Description, Check, Fix, CCI, and NIST control mapping — but nothing is populated here until a real DISA STIG/CCI dataset is ingested.
Learn more about STIG/CCI integration →Evidence
Categorized from the SP 800-53A "Examine"/"Test" artifact list above by keyword — not an authoritative NIST evidence list.
Policy
- Personally identifiable information processing and transparency policy and procedures
- consent policies and procedures
- privacy plan
Testing
- Organizational processes for the collection of personally identifiable information
- consent tools or mechanisms for users to authorize the processing of their personally identifiable information
- mechanisms implementing consent
Other Records
- consent tools and mechanisms
- consent presentation or display (user interface)
- evidence of individuals� consent
- other relevant documents or records