GDPR consent wording for lead forms, with examples.
Last updated
7 min readThis guide explains the basics and is not legal advice. Ask your own counsel.
In short
Valid consent is freely given, specific, informed and unambiguous, and it needs a clear action such as an unticked box that the person ticks. Name who is asking, say what for, link your privacy notice, keep marketing separate, and store the exact wording with a version number and a time.
Decide whether you need consent at all.
Consent is one of several lawful bases in Article 6 of the GDPR. In B2B, replying to an enquiry that a visitor made at your stand can often rest on legitimate interests instead. Marketing is different. The ePrivacy rules that your country applies to e-mail marketing often require consent, and some countries treat company addresses differently from personal ones.
In practice many exhibitors use a checkbox for both. That is fine if the wording matches what you actually do. This guide covers the wording. The legal basis, retention and requests are in GDPR-compliant lead capture at events.
What valid consent needs.
Article 4(11) defines consent as a freely given, specific, informed and unambiguous indication of the person's wishes, given by a statement or a clear affirmative action. Article 7 and recital 32 add the practical rules.
- Included: Freely given: the person can say no without losing something unrelated (Article 7(4)).
- Included: Specific: one purpose per request. Recital 32 says consent should cover all activities for the same purpose, and separate consent for several purposes.
- Included: Informed: the person knows who is asking and why. Articles 13 and 14 list what to tell them, such as your identity, the purposes, the legal basis, recipients, how long you keep the data and the right to withdraw.
- Included: Unambiguous: silence, pre-ticked boxes and inactivity are not consent (recital 32). The person must act.
- Included: Provable: you must be able to demonstrate it (Article 7(1)).
- Included: Withdrawable: it must be as easy to withdraw consent as to give it (Article 7(3)).
Article 13 applies when you collect data from the person, as on a lead form. Article 14 applies when you got their details somewhere else, for example a list from an organiser. The European Data Protection Board's Guidelines 05/2020 on consent explain all of this in more detail.
Keep 'contact me about this' apart from 'send me marketing'.
These are two purposes, so they need two requests. Contacting someone about the thing they asked for is part of answering them. Adding them to a newsletter is another purpose, with its own box, which must be optional. If a visitor cannot get a reply without agreeing to marketing, the marketing consent is not freely given.
Put the contact request first, required to submit if you wish. Put the marketing box second, unticked, with a plain label. Do not let a click on the second box change anything about the first. The form questions guide shows where both sit in a short form.
Six wordings you can adapt.
The examples use a fictional company, Harbourline Freight. Replace the name, the channel and the purpose with your own.
| Use | Wording | Why it works |
|---|---|---|
| Contact about this request | Harbourline Freight may contact me about this request. See the privacy notice. | Names the controller and the purpose, short enough to read |
| Reply by e-mail | I agree that Harbourline Freight may e-mail me a reply to this enquiry. | States the channel and the single purpose |
| Marketing e-mail, separate box | Send me news about Harbourline Freight services by e-mail, about once a month. I can unsubscribe at any time. | Optional, gives the frequency, says how to withdraw |
| Meeting request | I agree that Harbourline Freight may use my details to confirm and manage this meeting. | Limits use to the meeting |
| Sharing with a partner | I agree that Harbourline Freight may share my name and e-mail with Example Partner Ltd so they can contact me about integration. | Names the recipient and the reason, in its own box |
| Phone call | You may call me on the number I gave about this request. | Covers a phone number given as optional |
Three wordings that fail.
| Wording | Why it fails |
|---|---|
| By submitting this form you agree to our terms and to receive marketing. | Bundles purposes, uses no clear action and makes marketing a condition of the reply |
| A pre-ticked box: Keep me updated about offers | Recital 32 says pre-ticked boxes are not consent |
| I consent to the processing of my personal data. | Names no controller and no purpose, so the person is not informed |
Legalese does not help either. Article 7(2) asks for a request in an intelligible and easily accessible form, in clear and plain language. If a visitor cannot read the sentence at arm's length in a noisy hall, shorten it.
Store the proof with every lead.
If you rely on consent, you must be able to show it. A tick in a column is not proof. Store, for every lead:
- Included: The exact wording the person saw, not a pointer to the current wording.
- Included: The version number of that wording.
- Included: The time the person agreed, with the time zone.
- Included: The source: which form, page or placement.
- Included: Whether the marketing box was ticked, as its own value.
A stored record can be as plain as this: 'Harbourline Freight may contact me about this request. See the privacy notice. (wording v3)', received 2027-02-03 at 11:42, from the banner QR code, marketing box not ticked. That one line answers who, what, when and where if anyone asks.
Keep the privacy notice versioned as well, so you can show what it said on the day. Do not store more personal data than you need to prove the consent. An IP address is not needed for this.
Translate with care and change with a version.
If visitors speak several languages, show the wording in theirs. Translate the sentence, then have a native speaker check it. A machine translation that changes who may contact whom is a different consent. Here is the first wording in three languages, as drafts only.
| Language | Draft |
|---|---|
| German | Ich bin einverstanden, dass Harbourline Freight mich zu dieser Anfrage kontaktiert. Siehe Datenschutzhinweis. |
| French | J'accepte que Harbourline Freight me contacte au sujet de cette demande. Voir l'avis de confidentialité. |
| Spanish | Acepto que Harbourline Freight me contacte sobre esta solicitud. Consulte el aviso de privacidad. |
Withdrawal needs a route too. Say in your first e-mail how to stop, for example by replying 'stop', and honour it at once. Then keep the person on a short suppression list so a later import does not add them again by mistake.
When you change the wording, give it a new version and keep the old one. A person who agreed to version 2 did not agree to version 3. If the change widens the purpose, ask again before you use the wider purpose on old leads. If it only fixes a typo, a new version is still the clean record.
At a stand with little space.
Printed material has room for little more than your name, a line on why and a link. Put exactly that next to the QR code, and let the form carry the real consent request.
- Included: Short line on the print: 'Scan to share your details with Harbourline Freight. We reply to your request only.'
- Included: A short link to the privacy notice, for example
example.com/privacy. - Included: No consent is given by scanning. The ticked box on the form is the act.
- Included: Print the link in at least 8 pt so it can be read without a scanner.
Keep the printed line consistent with the form's wording. The lead capture checklist in how to capture and follow up trade show leads covers the rest of the stand.
A consent wording checklist.
- Step 1.
Decide which purposes need consent and which rest on another basis.
- Step 2.
Write one request per purpose, in plain language, in the first person.
- Step 3.
Name your organisation and link the privacy notice.
- Step 4.
Leave every box unticked and keep marketing optional.
- Step 5.
Store the wording, version, time, source and marketing choice with each lead.
- Step 6.
Have a native speaker check each translation.
- Step 7.
Bump the version whenever the text changes.
- Step 8.
Make withdrawal as easy as agreeing, and say how in your first e-mail.
Quick answers.
What should a GDPR consent checkbox say?
It should name who is asking, say what for in plain words and link to the privacy notice, for example 'Harbourline Freight may contact me about this request. See the privacy notice.' The box must be unticked and the person must tick it themselves.
Can the consent box be pre-ticked?
No. Recital 32 of the GDPR says silence, pre-ticked boxes or inactivity do not constitute consent. The person has to take a clear action.
Do I need a separate checkbox for marketing e-mails?
Usually yes. Contacting someone about their request and adding them to a newsletter are different purposes, and marketing consent must be optional. Ask your data protection officer about the rules in your country.
What should I store as proof of consent?
The exact wording the person saw, its version number, the time they agreed, the source of the form and whether they ticked marketing. A tick in a column without the wording is weak proof.