Most requests for a GDPR checkbox example are really requests for one sentence to paste next to a tick box. The sentence is the easy part and it is written out below. The harder part is that the same tick box can be valid or worthless depending on what else is on the form, whether the service is conditional on it, and whether anything was recorded at the time. That is where the regulation puts its conditions, and it is where audits find problems.
What the regulation asks of a tick box
Four provisions do the work, and they are short enough to read directly.
Article 4(11) defines consent as "any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her".
Recital 32 says what that looks like in a browser: ticking a box when visiting an internet website counts, and then states the limit directly. "Silence, pre-ticked boxes or inactivity should not therefore constitute consent." The same recital adds that where processing has several purposes, consent should be given for all of them.
Article 7(2) governs the layout. Where consent sits inside a written declaration that also concerns other matters, the request for consent must be "presented in a manner which is clearly distinguishable from the other matters, in an intelligible and easily accessible form, using clear and plain language", and any part of such a declaration that infringes the regulation is not binding.
Article 7(3) governs the exit. The person may withdraw at any time, must be informed of that right before giving consent, and "it shall be as easy to withdraw as to give consent".
Two more points close the frame. Article 7(1) puts the burden of proof on the organisation: it must "be able to demonstrate that the data subject has consented". Article 7(4) and Recital 43 deal with bundling, and Recital 43 is blunt about it: consent is presumed not to be freely given where separate consent is not allowed for different processing operations, or where performance of a contract is made dependent on consent that is not necessary for it.
Example wording, written out
Each example below is a label for a single unticked box. Acme Ltd stands in for the organisation's name, which should be the actual legal entity rather than a brand.
For a newsletter, where the only purpose is the newsletter:
Yes, send the Acme Ltd monthly newsletter to this address. Unsubscribe from any email, at any time.
For marketing email that is genuinely separate from an enquiry:
Yes, Acme Ltd may send email about products and offers to this address. This is separate from a reply to the enquiry above, and can be stopped at any time from a link in any email.
Where a second purpose exists, it gets a second box rather than an extra clause:
Yes, Acme Ltd may share the details above with the installer covering this area, so they can quote directly.
For an event where a list of attendees will be visible:
Yes, show the name and organisation given above on the attendee list shared with other participants.
For a recruitment form, where a CV will be kept past the current vacancy:
Yes, Acme Ltd may keep this application on file for twelve months and make contact about similar roles.
For special category data under Article 9, which the regulation prohibits processing unless a condition such as explicit consent applies:
Yes, and explicitly so: Acme Ltd may record the dietary and accessibility needs given above, for use in arranging this event only.
Four things are true of all of them. The box is not ticked when the page loads. The label says who, what, and for what purpose, in that order. One box covers one purpose. And the sentence is readable at a glance, because a label nobody finishes reading is not informed consent.
The wording to avoid, and why
Some very common phrasings fail on their face.
A single box combining terms, privacy, and marketing. This is the case Article 7(2) is written for, and the consequence is stated in the same paragraph: the infringing part is not binding, and the consent for marketing goes with it.
A box labelled I agree to the privacy policy. A privacy notice is information the organisation is obliged to give under Article 13. Agreeing to it is not consent to any particular processing, so this box proves nothing about anything.
A pre-ticked box, however clearly labelled. Recital 32 rules it out in one sentence, and so did the Court of Justice in the Planet49 case.
"By submitting this form you consent to..." Submitting a form to get an answer is not a clear affirmative action about marketing. It is an action about the enquiry.
"Untick this box if you do not want emails." An opt out is inactivity dressed as a choice, and inactivity is named in Recital 32 as insufficient.
A required box where the service does not need it. Making a download conditional on marketing consent runs directly into Article 7(4) and Recital 43.
When consent is the wrong basis entirely
This is the most useful part of the subject and the least covered. Many forms carry a consent box for processing that does not need consent, which adds an obstacle, weakens the record, and creates a withdrawal obligation for data that was never held under consent in the first place.
A contact form is the clearest example. Someone who fills in an enquiry and presses send expects a reply, and the processing needed to send it does not rest on a tick box. Article 6 offers other lawful bases, and the appropriate one for an enquiry is generally not consent. What still applies in full is Article 13: at the point of collection, the person must be told who the controller is, the purposes and the legal basis, the recipients, how long the data will be kept, their rights, and the right to complain to a supervisory authority. A link to a privacy notice, positioned where it will be seen before the submit button, satisfies that. A tick box adds nothing.
| What the form does | Is consent the right basis | What the form should show |
|---|---|---|
| Takes an enquiry and replies to it | Usually not | A privacy notice link and the retention period, no box |
| Adds the address to a marketing list | Yes | One unticked box, separate from the enquiry |
| Passes details to a partner who will make contact | Yes | A separate box naming the partner or the category |
| Collects health, dietary, or accessibility needs | Explicit consent, or another Article 9 condition | A separate box using the word explicitly, purpose limited |
| Publishes a name on a public attendee list | Yes | A separate box saying where the name appears |
| Records the submission to fulfil an order | No, a contract basis applies | A privacy notice link, no box |
That table is worth walking through against the forms already live on the site, since the situations where intake forms are used differ enough that one policy rarely fits all of them. The practical test is a single question: if this box were left unticked, would the organisation still do the thing described. If the answer is yes, the box is decoration and it should be removed. If the answer is no, the box belongs, and it needs a record.
Where the box sits on the page
Placement decides whether the wording is read, and it is the part most often left to whatever the form builder does by default.
Put the consent boxes directly above the submit button, after the questions. A box near the top is read before the person has decided to submit anything, which is the wrong moment for a decision about future email. A box hidden below the button is not read at all.
Keep the privacy notice link separate from the consent boxes and label it as information rather than as something to agree to. "How this information is used" as link text is accurate. "Terms and privacy" next to a tick box invites exactly the bundling that Article 7(2) prohibits.
Give the label its own line at full width. On a phone, a long label beside a small box wraps into a block of grey text that is skipped, and a skipped label is not an informed one. Font size matters here for the same reason: consent text set smaller than the rest of the form is a signal that it is not meant to be read, and a regulator reading the page will see the same signal.
Never disable the submit button until an optional box is ticked, and never style an optional consent box the way required fields are styled. Both turn a free choice into an apparent requirement, which is the substance of what Article 7(4) is about, whatever the label says.
State the retention period near the box when the consent involves keeping something, such as a CV on file. It is required information under Article 13 and it removes the most common follow up question about it.
Keeping the proof
Article 7(1) requires the organisation to be able to demonstrate that consent was given, which means the tick alone is not enough. What has to survive is the state of the page at the moment of the tick.
Four items make a defensible record. Which boxes were ticked, stored as separate values rather than one combined flag. The exact text that was displayed, or a version identifier pointing at stored text, since wording changes and a record referring to today's wording proves nothing about a submission from last year. The timestamp. And the form or page the submission came from.
The failure mode is consistent across tools: the consent question is stored as a yes or no next to a submission, the wording is edited six months later, and the record now attests to a sentence the person never saw. Keeping the consent text under version control, or storing the text with the response, is what turns a database column into evidence. Where the form tool keeps a per response history of changes, that history is worth checking for exactly this, and the record keeping features matter more here than the editor does.
Two adjacent habits are worth adopting. Keep the consent fields out of free text, because a note reading "said yes on the phone" is not a record of a clear affirmative action. And keep marketing consent separate from the enquiry in storage as well as on screen, so that a later export of people to email does not quietly include everyone who ever sent a message.
Withdrawal, in practice
Article 7(3) requires withdrawal to be as easy as giving consent. In practice that means an unsubscribe link in every marketing email, and a route that does not require signing in to an account the person may not have.
Two things follow that are easy to get wrong. A withdrawal must stop the processing that rested on consent, and it must not delete the record that consent was once held, because that record is the proof required for the period it covered. And withdrawal of marketing consent does not oblige the organisation to delete an enquiry that was processed on a different basis. Treating one as the other is the most common overcorrection, and it usually results in useful records being destroyed.
What to change first
Go through the current form and count the boxes. For each one, ask whether the described activity would still happen if it were left unticked, and delete the ones where the answer is yes. Then check that whatever stores the submissions keeps each remaining box as its own field alongside the wording that was shown, because that pairing is the whole of Article 7(1) in practice. Anything involving Article 9 data is worth having a lawyer read once, since the wording has to be purpose limited rather than general. A tool that keeps each response, its consent fields, and its history together, as Halict does, removes the reconstruction work that makes this awkward later.
Q1. Does a contact form need a GDPR consent checkbox?
Usually not. Processing an enquiry in order to reply to it does not generally rest on consent, and Article 6 provides other lawful bases. What is required is the information listed in Article 13, given at the point of collection, which a clearly placed privacy notice link provides. A box is needed for anything extra, such as adding the address to a marketing list.
Q2. Can one checkbox cover the privacy policy and marketing together?
No. Article 7(2) requires a consent request inside a wider declaration to be clearly distinguishable from the other matters, and states that any infringing part of such a declaration is not binding. A combined box also fails the separate consent expectation in Recital 43. Two purposes need two boxes.
Q3. Are pre-ticked boxes ever allowed?
Not for consent. Recital 32 states that silence, pre-ticked boxes or inactivity do not constitute consent, and the Court of Justice reached the same conclusion in the Planet49 case. The box must start unticked and be ticked by the person.
Q4. What has to be stored to prove consent was given?
The value of each consent field separately, the exact wording shown at the time or a version reference to it, the timestamp, and where the submission came from. Storing only a yes or no is the common gap, because the wording is usually edited later and the record then refers to text the person never saw.
Q5. If someone withdraws consent, does the original enquiry have to be deleted?
Not necessarily. Withdrawal ends the processing that relied on consent, such as marketing email. Data held on a different lawful basis, such as an enquiry handled in order to answer it or a record kept for accounting, is governed by that basis and its own retention period. The record that consent existed should also be kept, since it is the proof for the period it covered.