The consent checkbox is the most cargo-culted element in web forms. Half the small-business forms out there carry one they don't need; many that do need one build it in a way that doesn't count. The actual rules are short.
A contact form. A quote request. A booking inquiry. The person is writing to you, asking you to respond — using their details to respond is exactly what they expect, and GDPR covers it without consent (as legitimate interest, or steps toward a contract). Adding an "I consent to the processing of my data" box to a plain contact form isn't extra safety; it's noise that trains visitors to tick boxes without reading them — and it quietly implies your form needs consent, which can backfire, since consent can be withdrawn.
Your transparency duty is real, but it's met by a short privacy note under the form, not by a checkbox.
The checkbox earns its place when you want to use the details for something beyond the obvious purpose of the form:
Each of those is a separate choice the visitor makes — which is exactly what a checkbox is for.
<label>
<input type="checkbox" name="newsletter_optin" value="yes">
Also send me the monthly newsletter (unsubscribe anytime)
</label>Note what's not there: no required attribute,
no checked. In the hform builder,
add a checkbox field and leave it optional — the submission then
records the choice with a timestamp, which doubles as your record of
consent.
Whoever ticks the box can untick it later — GDPR requires withdrawal to be as easy as consent. For a newsletter that's the unsubscribe link in every issue; honor it promptly and delete the address from the list, and the circle is closed.
No. Consent requires an affirmative act, and the EU’s top court has ruled pre-ticked boxes invalid. The box starts empty or it doesn’t count.
No. Consent must be freely given — if the visitor can’t send the form without agreeing to marketing, it isn’t consent. Required-for-marketing boxes are the classic invalid pattern.
Usually not. Reading a privacy notice isn’t something you consent to — the duty is that you inform, met by a visible note and link near the form. Acceptance checkboxes belong to actual contract terms, like creating an account.
Keep the record: the submission with the checkbox value and its timestamp. hform stores exactly that with each message, and it’s in your CSV export.
Build a form in two minutes: EU-hosted (Sweden), automatic retention limits, CSV export, published DPA. The honest part stays yours; the plumbing is done. Free plan included, plain pricing beyond it.
More on forms and privacy: GDPR for forms · Data retention · The privacy note · EU hosting — or see all guides.
This guide is plain-language orientation, not legal advice. For edge cases — special-category data, children's data, large-scale processing — talk to someone who does this for a living.