Abstract: To prevent malicious access to and misuse of privacy-sensitive data, data collectors must ensure users' explicit consent and autonomous control over the processing of their personal data, as mandated by modern data protection regulations. In existing approaches, user consent is mostly bound directly to data processing purposes. However, existing approaches suffer from vague semantics in consent derivation, weak alignment with the operational logic of data processing, and a lack of effective conflict resolution mechanisms, making it difficult to obtain legally valid and practically enforceable consent. To address these issues, a consent-based access control model is proposed, in which consent permissions are incorporated into the access decision process, and all personal data operations are abstracted as actions serving specific purposes. At the semantic level, the relationship between purposes and data operations is clarified, and an integrated semantic linkage among purpose, action, and consent is established. Following the principles of least privilege and deny-by-default, an asymmetric consent inheritance rule and a consent computation method tailored to hierarchical purpose structures are defined, thereby enabling fine-grained and context-aware access decisions. The model is formally specified in TLA+ (Temporal Logic of Actions Plus), and its core security properties are verified through model checking, ensuring both soundness and consistency. Experimental results on representative consent scenarios demonstrate that, compared with existing representative methods, the proposed approach can effectively resolve consent conflicts, reduce unintended over-authorization, and achieve better decision quality and compliance.