Explicit permission a user gives before any personal data is processed or shared, granular (per purpose), revocable at any time, and logged for audit under GDPR Art. 7.