A GDPR consent form should say who collects the data, what data is collected, why it is used, how consent can be withdrawn, and whether the data will be shared. It should use plain language, separate optional marketing consent from required service terms, and avoid pre-ticked boxes. A good form makes refusal as easy as acceptance.
TLDR: A compliant GDPR consent form must be specific, informed, freely given, and easy to withdraw. For example, a lead form might ask for an email address to send a pricing guide, then show a separate unchecked box for weekly marketing emails. In one B2B campaign, a company that cut five fields down to two saw form completion rise from 18% to 31%, while keeping consent cleaner. Better consent often means fewer leads, but higher-quality leads.
What a GDPR Consent Form Must Do
A GDPR consent form is not just a checkbox at the bottom of a page. It is a clear record that a person agreed to a specific use of personal data. Under the GDPR, consent must be freely given, specific, informed, and unambiguous.
That means the user must understand what is happening before clicking. The wording should not hide marketing permissions inside long terms. It also should not make consent feel forced unless the data is truly needed for the service.
It drives privacy teams crazy that many tools still add vague text like “By submitting, consent is given to receive updates.” That wording is weak. Updates about what? From whom? How often? A sharper version performs better from a compliance view and feels more honest.
Required Elements in a GDPR Consent Form
A practical GDPR consent form should include these core parts:
- Controller identity: The legal name of the company or organization collecting the data.
- Purpose: A clear reason for collecting the data, such as sending a quote, delivering a download, or sending product emails.
- Data categories: The type of data collected, such as name, email, phone number, company, or preferences.
- Consent action: A clear affirmative action, usually an unchecked checkbox or toggle.
- Withdrawal method: Instructions for unsubscribing or changing consent later.
- Privacy notice link: A link to the full privacy policy, written in readable language.
- Separate choices: Different consent requests should not be bundled together.
- Proof of consent: The business should store when, how, and what the person agreed to.
The form should also avoid dark patterns. Consent is not valid if a user feels trapped. For example, a newsletter box should not be required to download a receipt or complete a purchase.
Practical GDPR Consent Form Example
Here is a simple example for a lead magnet form:
Download the 2026 Pricing Guide
Enter an email address to receive the guide. The company will use this email only to send the requested guide unless marketing consent is selected below.
- Email address: [required field]
- First name: [optional field]
Yes, send weekly product tips and offers by email. Consent can be withdrawn at any time by clicking the unsubscribe link in any email.
Personal data is handled according to the Privacy Policy.
This example works because the download request and marketing consent are separate. The email is needed to send the guide. The marketing emails are optional. The checkbox is not pre-selected.
Clear Consent Language That Works
Consent wording should be short. It should say exactly what the user gets. Legal jargon weakens consent and lowers trust.
Weak language: “The user agrees to be contacted for promotional and related purposes.”
Better language: “Yes, send monthly product updates and discount offers by email. Consent can be withdrawn at any time.”
Weak language: “The company may process data in accordance with applicable policies.”
Better language: “The company will use the email address to send the requested webinar recording.”
Good consent language answers three questions fast:
- What will happen?
- Who will do it?
- How can the person stop it?
If the answer takes a paragraph of legal fog, the wording is too heavy.
Example Consent Text for Common Use Cases
Newsletter Signup
“Yes, send the monthly newsletter by email. The newsletter includes company news, product tips, and offers. Consent can be withdrawn at any time using the unsubscribe link.”
Webinar Registration
“The company will use this information to register the attendee for the webinar and send event reminders. Marketing emails will only be sent if the box below is selected.”
Contact Form
“The company will use the details provided to respond to this request. The information will not be used for marketing unless separate consent is given.”
SMS Marketing
“Yes, send promotional text messages to this phone number. Message frequency may vary. Consent can be withdrawn by replying STOP.”
Each example uses plain words. Each purpose is separate. That is the point.
Privacy-Friendly Lead Collection
Lead forms often collect too much data. Honestly, it feels like some sales forms ask for half a passport just to send a PDF. That creates friction and raises risk.
A privacy-friendly lead form should collect only what is needed. If an email address is enough, the form should not require a phone number, job title, company size, and budget. Extra fields can be optional, but optional should really mean optional.
The best lead forms often follow this structure:
- Required: Email address, if needed to deliver the resource.
- Optional: Name or company, if useful for personalization.
- Separate consent: Unchecked checkbox for marketing emails.
- Short notice: One or two lines explaining the processing.
- Policy link: A clear link to the full privacy notice.
This approach can also improve lead quality. A person who actively selects marketing emails is more likely to engage. A forced subscriber may unsubscribe fast or report messages as spam.
Consent Records and Proof
GDPR consent is not only about the front-end form. The business must be able to prove consent later. That evidence should include the date, time, form version, consent wording, source page, and user identifier.
If the wording changes, the company should keep a record of the old version. Otherwise, it may be hard to show what the person agreed to at the time. This matters during audits, complaints, and email platform reviews.
Common Mistakes to Avoid
- Pre-ticked boxes: These do not count as valid GDPR consent.
- Bundled consent: One checkbox should not cover newsletters, partner offers, SMS, and profiling.
- Vague wording: “Updates” and “communications” are often too broad.
- Hard withdrawal: Unsubscribing should not require logging into an account or sending a letter.
- Forced marketing: Marketing consent should not be required for a basic download unless it is clearly the exchange being offered.
FAQ
Does every contact form need a GDPR consent checkbox?
No. If the form is used only to answer a request, consent may not be needed. The company can often rely on legitimate interest or steps before a contract. Marketing use should still require separate consent in many cases.
Can a GDPR consent checkbox be pre-ticked?
No. Consent must involve a clear action by the user. A pre-ticked box is not valid consent under GDPR rules.
What is the best wording for marketing consent?
A strong version is: “Yes, send marketing emails about products, tips, and offers. Consent can be withdrawn at any time using the unsubscribe link.”
How long should consent records be kept?
They should be kept as long as the business relies on that consent, and long enough to handle complaints or legal claims. Retention should be defined in the privacy policy.
Is consent needed for a lead magnet download?
Consent is not always needed to send the requested download. Separate consent is usually needed if the business also wants to add the person to a marketing list.