On 2 March 2017, in preparation for the new EU General Data Protection Regulation (GDPR) coming into force on 25 May 2018, the Information Commissioner’s Office (ICO) released its draft guidance on consent for public consultation. The draft guidance makes it clear that obtaining valid consent under the GDPR will be significantly more difficult than under the current law. In particular, it expressly states that “opt-out” consents will no longer be valid and that businesses will need to obtain positive “opt-in” consents in order to comply with the GDPR. In addition, third party consents will only be valid if the third party sending the marketing was specifically identified in the consent wording. As it currently stands, the guidance is likely to require the majority of businesses to go out and seek new consents in order to continue their marketing activities post the GDPR coming into force. This is not only due to the need for specific, opt-in consents, but also due to the obligation to be able to demonstrate that consent has been obtained. Businesses will need to be able to prove when and how consent was obtained and what information individuals were given at the time. Many businesses will not have these detailed records. The take-up for new consents is notoriously low, which could hit revenues hard. The consultation will run until 31 March 2017 with the ICO aiming to publish the finalised guidance in May 2017.