The GDPR allows ordinary personal data to be collected and used on the basis of "unambiguous" consent. For sensitive data, it requires "explicit" consent. The difference between these two standards has attracted excited debate in privacy circles, with some arguing that they are one and the same thing and that the GDPR no longer allows consent to be implied. But is that correct? Is implied consent really no longer possible under the GDPR? This post explores both standards of consent and explains that, while they share many similarities, there are subtle differences and that - in appropriate contexts - implied consent is still possible.