Rules for obtaining valid consent to use personal information will become much tougher when the GDPR comes into the force. Therefore, companies must ensure that consent is clear, affirmative, and in plain language. Companies must also make it easy for data subjects to withdraw content if they wish to do so.