GDPR consent checkbox for a form
A consent checkbox is the usual way to show that someone agreed to their details being used for a stated purpose. Under the GDPR, a checkbox only counts if it is clear, separate and unticked until the person ticks it. This page sets out the form side of that, and the points where a form is most often wrong.
What the GDPR asks of consent
Article 4(11) of Regulation (EU) 2016/679 defines consent as a freely given, specific, informed and unambiguous indication of the person’s wishes, given by a statement or by a clear affirmative action. Article 7 adds that the request must be clearly distinguishable from other matters, in plain language, and that withdrawing consent must be as easy as giving it.
Each of those words becomes a form design decision. Freely given rules out a box that is required for a service that does not need the data. Specific rules out one box for several purposes. Unambiguous rules out a box that is already ticked.
One checkbox per purpose
If you will use someone’s details for a newsletter and also share them with a research partner, give each purpose its own checkbox with its own wording. A single “I agree to everything” box cannot be specific, and it means a person who wanted only the newsletter has agreed to the research as well.
In a Seagit form, add one checkbox field per purpose. Each one is stored as its own answer, so the CSV export shows which people agreed to which purpose, and you can filter by that column before you use the data.
Leave the box unticked
The checkbox must start empty, and the person must tick it. Planet49 concerned cookies, but the Court’s reasoning on a pre-ticked box applies to consent more generally: a box someone did not touch is not an indication of their wishes. Check the form in a private window and confirm the box is empty before you publish.
Say what the consent covers, with a link
The wording beside the box has to say what the person is agreeing to: which data, for what purpose, and for how long if you know. Link to your privacy notice from that sentence. In a Seagit form, a Styled Paragraph block lets you write that sentence with a link above the checkbox. Links to https addresses and to email addresses are supported, so the notice can be on your own site or in an email.
The privacy notice is the place for the detail: who you are, how to contact you, how long you keep the data and the rights people have. The sentence beside the box should point to it rather than repeat it all.
Required only where the service needs it
Turn on Required for a checkbox only when the thing the person is asking for cannot happen without that consent. Each field has its own Required setting. A newsletter sign-up can be optional, so the person can join the list or not without the rest of the form changing. A booking that needs a contact address to confirm is different, and the box can be required because it is part of the service.
Keeping and deleting what you collected
Responses export to CSV, so the consent answers can be kept with the rest of the record. Deleting a form deletes its responses with it, so a form you no longer need is also a way to remove the data it held. That does not replace a deletion process for people who ask you to delete their data, which you have to run yourself.
This page describes the form, not the law around it. For a decision that depends on your data, your country and your sector, ask a privacy professional. Nothing here is a guarantee that a form you build is compliant.
Common questions
- Does a consent checkbox make a form GDPR compliant?
- No. A checkbox is one part of a lawful process. You still need a lawful basis for each purpose, a privacy notice, a retention decision and a way for people to exercise their rights. A Seagit form does none of that on your behalf, and this page is not legal advice.
- Should the consent box be ticked by default?
- No. In Planet49 (Case C-673/17, 2019) the Court of Justice of the European Union held that a pre-ticked checkbox does not give valid consent. The person has to take an active step to tick the box.
- Should one checkbox cover every use of the data?
- Separate purposes need separate checkboxes. The GDPR definition of consent in Article 4(11) requires it to be specific, which in practice means one request per purpose. A newsletter and a research invitation should each have their own box, so the person can agree to one without the other.
- Can the consent checkbox be optional?
- Yes, by leaving Required switched off. Make it required only when the service genuinely depends on that consent. Making agreement a condition of a service that does not need the data is the bundling Article 7(4) warns about, and it weakens the consent.