Obtaining explicit consent via on-site forms under GDPR: Is a checkbox mandatory?

In France, one of the most common mistakes that lead to fines during audits is making marketing consent a prerequisite for general communication. You cannot force a user requesting a quote onto your newsletter. As long as you don't make the box mandatory, your conversion rates won't drop the way you fear.

Don't forget to log consent on the backend. When a visitor checks the box, simply recording a true/false value in the database isn't enough; you should also store their IP address at the time, the timestamp, and the version number of the privacy policy they agreed to. The burden of proof is entirely on you.

Don't be afraid to add the box. Just put a single unticked checkbox right above the submit button that says 'I want to subscribe to the newsletter to stay updated.' Only send a quote response to those who don't check it, and that will eliminate your legal risk.

We faced the exact same dilemma on our Paris-based website. Before adding the box, the conversion rate on the quote form was around 4%; after adding an optional newsletter box, it went to 3.8%. Conversions barely dropped at all, but open rates for newsletter subscribers jumped above 60% because only the people who genuinely wanted it opted in.

Are you making the phone number field mandatory? If you're only delivering the quote via email, requiring a phone number might conflict with the data minimization principle. Have you considered making that field optional?

the partners at our agency had the exact same argument, we ended up adding the checkbox but honestly no one bounced don't worry about it, if you get hit with a fine that 450 euro budget won't save the company anyway.

Under GDPR regulations, consent must be freely given. Tying a service request to marketing consent that has no direct connection to said request renders the consent legally invalid. Accordingly, the consent mechanism must be structured independently.

What if we just put a generic line under the form saying 'By clicking Submit, you agree to subscribe to our newsletter' wouldn't that count as valid consent? btw does it really have to be an actual checkbox you tick?

It's rare to find an explanation this clear.

Thanks for writing this, that's the right way. An automated scan report is not the same as a penetration test.

The harder it is to reverse a decision, the slower you should make it. Proven by experience.

good call starting this thread and dont hesitate to ask; those who dont ask always pay more.

hope this helps.

This thread is archived.

If I understood correctly, you're saying: Just because everyone does it doesn't mean it's right.

Hope this helps.

Thanks for writing this, that's the right way. If you get three different answers on a topic, the question was asked wrong.

Trying to do this alone is the most expensive way. This is my opinion, I'm not claiming it's absolute truth.

I completely agree. The harder it is to reverse a decision, the slower you should make it.

Of course, it varies if your situation is different.

saved. don't rely on a single measure; go layer by layer.

when you try to change everything at once nothing settles. if you post the result here, it will help others too.

You're right. Solutions that work at a small scale collapse when you grow; I learned this late.

When we decide without measuring, we always end up in the same place. If I were you, I'd go this route.

i've been down this road let me tell you but taking notes for two weeks yields better results than a six-month estimate.

good luck with that.