Consent checkboxes on website forms under the GDPR

A website form does not always need a consent checkbox. Under the GDPR, consent is one of six lawful bases for using personal data. When someone asks you for a quote or a call back, you can use their details to answer on a different basis: steps taken at their request before a contract. What every form does need is a short privacy notice where the data is collected, saying who you are, why you want the details and where to read more. Consent comes in when you want to do something the person did not ask for, such as sending them marketing emails. Then it needs its own box that they tick themselves.

We looked at stepFORM forms that ask for a phone number or email and received responses over the last 12 months. Almost all of them come from Russian-language accounts rather than GDPR markets, but the gaps look familiar. 26% use the built-in consent line under the submit button, 7% have their own consent checkbox, and 21% mention consent or a privacy policy only in the form's text. In 46% we found nothing at all. Among the forms with their own checkbox, 9% had it ticked in advance.

Does your form need consent?

Personal data under the GDPR is any information relating to a person who can be identified, directly or indirectly (Article 4 of the regulation). A name with an email address or phone number qualifies. So does a CV uploaded through a careers form. The business that decides why the form exists and what it collects is the controller. That stays true when a form builder stores the answers: the builder becomes one of the recipients you name in your privacy notice.

Article 6 lists six lawful bases, and three of them come up with forms: consent, a contract (including steps taken at the person's request before one) and legitimate interests. Which one fits depends on what the form is for.

The choice is yours to make, and to write down in the privacy notice. If you are unsure, the UK regulator's guidance on consent has a section on when consent is appropriate and when another basis suits better.

What makes consent valid

If you do rely on consent, the bar is high. Article 4(11) asks for a "freely given, specific, informed and unambiguous" indication, given by a statement or "a clear affirmative action". Recital 32 spells out what that means on a website: "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." Article 7 then adds four rules that change how a form looks.

• You can prove it. The controller has to be able to show that the person consented (Art. 7(1)), so keep the record of when and how the box was ticked.
• It stands apart. A consent request inside a declaration that covers other matters must be clearly distinguishable from them (Art. 7(2)). One box for your terms, your privacy policy and your newsletter fails here.
• Withdrawing is as easy as agreeing. If opting in took one click, opting out should not take a letter (Art. 7(3)).
• The service does not hang on it. A form that will not send until people accept marketing makes that consent hard to call freely given (Art. 7(4)).

What the privacy notice next to the form should say

Article 13 lists what people must be told at the moment you collect their data. The full list lives in your privacy notice, and the form carries a short line with a link to it. The notice covers:

• Who you are and how to reach you, plus your data protection officer if you have one.
• Why you collect the data and on what basis. If the basis is legitimate interests, say what those interests are.
• Who receives it: the form builder, your CRM, a call centre, and any transfer to another country.
• How long you keep it, or how you decide.
• People's rights: access, correction, erasure, restriction, objection and portability, the right to withdraw consent where you rely on it, and the right to complain to a supervisory authority.
• Whether they have to give the data and what happens if they don't.

The line under the form can be as short as "We'll use your details to reply to your request. Read our privacy notice." Link the last words to the full notice on your site. If the form opens from a direct stepFORM link rather than on your site, there is no site footer next to it, so the link has to be inside the form itself.

Marketing emails need their own opt-in

Emails and texts that promote your business follow a second set of rules on top of the GDPR. In the UK that means PECR, the Privacy and Electronic Communications Regulations, and the ICO's summary is blunt: "You must not send marketing emails or texts to individuals without specific consent." There is a limited exception for your own previous customers, known as the soft opt-in. EU countries apply their own national rules under the ePrivacy Directive, so check the ones where your customers live.

On a form this means a separate box with specific wording, for example "Email me news and offers from [your business]". Leave it unticked and optional. People who skip it still get their quote, and the ones who tick it have actually asked for your emails.

How to set it up in stepFORM

Everything below works on every stepFORM plan, including Free.

1. A privacy line for a request form. Add a Text element under the fields with your notice, for example "We'll use your details to reply to your request. Read our privacy notice." Select the words "privacy notice", click the link icon and paste the address of your privacy page.
2. Or the built-in line under the button. Click the gear icon on the submit button, open Privacy Policy under Additional and switch on Activate. A line appears under the button, "By clicking the button, I agree to the processing of personal data", and its last words open a document. Click Edit document and replace the default text with your own notice. Restore document brings the default back.
3. A marketing opt-in. Add a Checkbox element with one option such as "Email me news and offers". Leave it unticked and keep Required selection switched off in its Validation settings.
4. A test run. Send one test response with the box ticked and one without. Both should go through, and each response should show whether the box was ticked.

The built-in line talks about agreeing to processing. If your form relies on the request itself rather than consent, the Text element from step 1 describes what actually happens more honestly. Each response keeps the ticked option and the date it arrived, which is the kind of record you need to show consent later.

For the form itself, from fields to notifications, see our guide on how to add a contact form to your website. Plans and limits are on the pricing page.

GDPR fines

The top tier covers the basic principles, including the conditions for consent in Articles 5, 6, 7 and 9, and people's rights under Articles 12 to 22, which include the Article 13 information duties. It goes up to €20 million or 4% of the previous year's worldwide turnover, whichever is higher (Article 83(5)). A lower tier of up to €10 million or 2% covers other duties, such as records and security. The supervisory authority sets the actual amount case by case, weighing factors listed in Article 83(2), such as how serious the breach was and how long it lasted.

When someone withdraws consent

People can withdraw consent at any time, and withdrawing has to be as easy as giving it (Article 7(3)). Put an unsubscribe link in every marketing email and act on it. If consent was the only basis for holding someone's data, they can also ask you to erase it (Article 17(1)(b)). Remember the copies: the form response, the email notification, the CRM record, the spreadsheet export.

Before you publish the form

• A privacy line with a link sits on every form that collects contact details.
• Consent boxes start empty.
• Marketing has its own box, and the form sends without it.
• The notice is complete: who you are, purposes and basis, recipients, retention and rights.
• The words under the button match your basis. Don't write "I agree" if you are not relying on consent.
• Every marketing email carries an unsubscribe link.

Frequently asked questions