> GDPR consent form examples with ready-to-adapt wording: newsletter, contact, checkout, photo release. Learn what to include and how to prove consent. > > Canonical: https://www.flowconsent.com/en/blog/gdpr-consent-form-examples [Regulation](https://www.flowconsent.com/en/blog?category=regulation) # GDPR consent form examples: 7 templates and wording that work By Roland Vekemans · Published 4 November 2026 · 7 min read In short A GDPR consent form is any form that asks people to agree to a specific use of their personal data: a newsletter sign-up, a marketing checkbox at checkout, a photo release, a research participation form, or a cookie banner. To be valid, consent must be freely given, specific, informed and unambiguous: an unticked checkbox per purpose, plain wording that names who you are and what you will do, and a way to withdraw as easy as the way to agree. Below are seven GDPR consent form examples with wording you can adapt, plus the cases where a form does not need consent at all. Forms are one of the places where personal data enters a website, and one of the first things a regulator looks at. They also belong in any [website cookie audit](https://www.flowconsent.com/en/blog/website-cookie-audit-complete-guide), because many form tools load their own scripts and cookies. This guide covers the consent side: what the checkbox should say, what the form must tell people, and how to keep proof. ## What is a GDPR consent form? Article 4(11) of the [GDPR](https://www.flowconsent.com/en/laws/gdpr) defines consent as a "freely given, specific, informed and unambiguous indication" of the person's wishes, given by a statement or a clear affirmative action. A consent form is simply the place where that action happens: the person ticks a box, clicks a button or signs a document. It is not a single legal template. A paper form for a school trip photo, an online newsletter widget and the cookie banner on your homepage are all consent forms if they rely on consent as the legal basis. What they share is a set of conditions, which our guide to [GDPR consent requirements](https://www.flowconsent.com/en/blog/gdpr-consent-validity-requirements) details one by one. ## When does a form need consent? Consent is only one of six legal bases in Article 6. Many forms do not need it, and asking for consent where another basis applies creates problems: if the person withdraws, you would have to stop processing data you actually need. - **Contact form:** answering the message is a step the person asked for. The legal basis is usually pre-contractual measures (Article 6(1)(b)) or legitimate interest, not consent. No checkbox is required to send the message. - **Order or account creation:** the data needed to deliver the order or run the account rests on the contract. - **Newsletter and marketing emails:** consent, in most cases. The ePrivacy rules require prior consent for marketing emails to individuals, with a narrow exception for existing customers and similar products (the "soft opt-in"), where an opt-out must be offered at collection and in every email. - **Sensitive data** (health, religion, biometrics): explicit consent under Article 9, unless another exception applies. - **Cookies and trackers** that are not strictly necessary: consent, under the ePrivacy Directive. The rule of thumb: ask for consent only for what is optional for the person. Our comparison of [opt-in vs opt-out consent](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent) explains why the EU model starts from "no". ## What a GDPR compliant consent form must include Two layers are needed: the consent itself, and the information notice required by Article 13. ### The consent mechanism - **An unticked checkbox or an active choice.** Recital 32 states that silence, pre-ticked boxes and inactivity are not consent. The Court of Justice confirmed it for pre-ticked boxes in the Planet49 case (C-673/17, 2019). - **One checkbox per purpose.** Newsletter, partner offers and profiling are three purposes, so three choices. A single "I agree to everything" box is not specific. - **No bundling with the terms.** Article 7(2) requires the consent request to be clearly distinguishable from other matters. "I accept the terms and conditions and agree to receive offers" fails. - **Not a condition of the service** when the data is not needed for it (Article 7(4)). ### The information next to the form Article 13 lists what people must know at the moment of collection. In practice, a short notice next to the button and a link to the privacy policy: - who you are (the controller) and how to contact you or your DPO; - the purpose of each processing and its legal basis; - the recipients, including processors such as your email platform; - how long the data is kept; - the right to withdraw consent at any time, and the other rights (access, erasure, objection, complaint to the authority); - transfers outside the EU, if any. The type of consent matters too: our article on [explicit and implied consent](https://www.flowconsent.com/en/blog/types-of-consent-explicit-implied) explains when an affirmative action is enough and when you need an express statement. ## 7 GDPR consent form examples The wording below is a starting point. Adapt the company name, purposes and retention periods to your real processing. ### 1. Newsletter sign-up \> ☐ I would like to receive the \[Company] newsletter (one email per month on product news and guides). I can unsubscribe at any time via the link in each email. \> \> \[Company] uses your email address only to send this newsletter, through \[email provider]. It is kept until you unsubscribe. More in our privacy policy. The box is unticked, the frequency and content are stated, and the withdrawal method is named. ### 2. Contact form \> We use your name and email to answer your message. Data is kept for 12 months after our last exchange. See our privacy policy for your rights. No checkbox: answering is what the person asked for. A box that says "I consent to the processing of my data" here is unnecessary and can mislead people into thinking they could not be answered otherwise. If you also want to add them to a mailing list, add a separate, optional, unticked box. ### 3. Account creation or checkout \> ☐ Send me offers and product news by email. \> ☐ Share my email with \[partner] so they can send me their own offers. The order goes through whatever the person chooses. Each optional purpose has its own box, and partner sharing names the partner. ### 4. Gated content (white paper, template, webinar) Making a download conditional on newsletter consent is risky under Article 7(4): the consent is no longer freely given if the person cannot get the content without it. A safer pattern: \> Enter your email to receive the guide. \> ☐ Also subscribe me to the monthly newsletter. ### 5. Photo and video release \> ☐ I agree that photos of me taken at \[event] may be published on \[Company]'s website. \> ☐ I agree that they may be published on \[Company]'s social media accounts. Separate channels, separate boxes. For minors, the consent of a parent or guardian is needed. For online services offered directly to children, Article 8 sets the age of digital consent at 16, which Member States can lower to 13 (France chose 15). ### 6. Health or research data \> ☐ I explicitly consent to \[Organisation] processing my health information described above for the purpose of \[study], as explained in the participant information sheet. Article 9 requires explicit consent: an express statement, often with a signature or a second confirmation step. Universities publish full templates for research consent forms that go further (study description, contacts, withdrawal procedure). ### 7. The cookie banner The cookie banner is the consent form most visitors see. The same rules apply: no pre-ticked categories, "Reject" as visible as "Accept", one choice per purpose, and a way to change your mind later. Our [GDPR cookie banner examples](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) show good and bad versions. Not sure what your banner actually blocks? Check in 30 seconds which cookies your site sets with the [free cookie scanner](https://www.flowconsent.com/en/scan). ## GDPR consent wording: what to avoid - "By using this site, you agree to…": continued browsing is not a clear affirmative action. - "I agree to the processing of my personal data" with no purpose: not specific, not informed. - Legal jargon or a 2,000-word notice in a popup: the request must use clear and plain language. - A withdrawal process harder than the sign-up, such as "write to our postal address". Article 7(3) requires withdrawal to be as easy as giving consent. - Wording that pushes ("No thanks, I don't like saving money"): manipulative choices undermine free consent. ## How to record and prove consent from a form Article 7(1) puts the burden of proof on you: you must be able to demonstrate that the person consented. For each consent, keep: - who consented (an identifier such as the email, not more data than needed); - when (date and time); - what they were shown (the version of the form and of the notice); - what they agreed to (each box ticked); - how (web form, paper form, double opt-in confirmation); - whether and when they withdrew. Double opt-in, where the person confirms through a link sent by email, is not written into the GDPR, but it is the usual way to prove that the email belongs to the person who ticked the box, and it is standard practice in Germany. The same logic applies to cookies: our guide on [proof of cookie consent](https://www.flowconsent.com/en/blog/proof-of-cookie-consent-what-to-store) lists what to store and for how long. Finally, check what the form page itself loads. Embedded form tools, chat widgets and reCAPTCHA can set cookies before any choice is made. Our guide on [how to check cookies on a website](https://www.flowconsent.com/en/blog/how-to-check-cookies-on-a-website) shows how to see them in the browser. ## Checklist for every consent form 1. Decide the legal basis for each purpose; ask for consent only for optional ones. 2. One unticked box per purpose, separate from the terms. 3. A short notice with the controller, purposes, recipients, retention and rights. 4. A withdrawal method as easy as sign-up, named on the form. 5. Records of who, when, what and how, linked to the form version. 6. A test of the page in a private window to see which scripts load before consent. ## How FlowConsent handles consent forms FlowConsent handles the consent form most visitors see first: the cookie banner. It blocks non-essential scripts before consent, gives Accept and Reject equal weight, offers one choice per category, and keeps each decision as exportable proof. The automatic cookie scan also flags trackers loaded by embedded form tools on your pages. Your own sign-up and marketing forms stay under your control: FlowConsent does not build them. What it can do is tell your backend about cookie decisions: [consent webhooks](https://www.flowconsent.com/en/doc/consent-webhooks) send a signed event to your server each time a visitor accepts, refuses or withdraws, so your records stay in one place. FlowConsent is free up to 25,000 sessions per month and installs in about ten minutes. [Back to the blog](https://www.flowconsent.com/en/blog) Share this article · [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-consent-form-examples) · [X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fwww.flowconsent.com%2Fen%2Fblog%2Fgdpr-consent-form-examples) Questions ## Common questions on this topic. Can't find your question? Write to us, we answer fast. [Write to us](https://www.flowconsent.com/en/demo) ### What is a GDPR consent form? A GDPR consent form is any form where a person agrees to a specific use of their personal data, such as a newsletter sign-up, a marketing checkbox or a cookie banner. It must collect a clear affirmative action, usually an unticked checkbox, explain who collects the data and why, and tell people they can withdraw consent at any time. ### Can you give an example of GDPR consent wording? For a newsletter: "I would like to receive the \[Company] newsletter, one email per month on product news. I can unsubscribe at any time via the link in each email." The box is unticked, the purpose and frequency are clear, and the withdrawal method is named. Add a short notice with the controller, retention period and a link to the privacy policy. ### Does a contact form need a GDPR consent checkbox? Usually not. Answering a message is what the person asked for, so the legal basis is pre-contractual measures or legitimate interest, not consent. You still need a short notice explaining how the data is used, how long it is kept and where to find the privacy policy. Add a separate, optional checkbox only if you also want to send marketing emails. ### Are pre-ticked checkboxes allowed under the GDPR? No. Recital 32 of the GDPR states that pre-ticked boxes, silence and inactivity do not constitute consent, and the Court of Justice of the EU confirmed it in the Planet49 case in 2019. The person must tick the box or make an active choice. The same rule applies to cookie banners: no category other than strictly necessary cookies may be preselected. ### How do you prove GDPR consent from a form? Article 7(1) requires you to demonstrate consent. Keep a record of who consented, when, which version of the form and notice they saw, which boxes they ticked, how they consented and whether they later withdrew. Double opt-in, where the person confirms by clicking a link sent by email, is the usual way to prove that an email address belongs to the person who signed up. Read next ## Keep reading. [All articles](https://www.flowconsent.com/en/blog) [Best practices · 15 July 2026](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) ### [GDPR cookie banner examples: best practices and templates](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) [Compliant and non-compliant cookie banners analysed, with the layouts that work, the dark patterns regulators sanction, text templates and a full checklist.](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices) [Read the article ](https://www.flowconsent.com/en/blog/gdpr-cookie-banner-examples-best-practices)· [Comparisons · 20 October 2026](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent) ### [Opt-in vs opt-out: the difference, with examples and GDPR rules](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent) [Opt-in vs opt-out explained: what each model means, how they differ for cookies and email marketing, and where the GDPR, the UK and US laws require one or the other.](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent) [Read the article ](https://www.flowconsent.com/en/blog/opt-in-vs-opt-out-consent)· [Comparisons · 22 October 2026](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) ### [First-party vs third-party cookies: differences, examples and GDPR](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [What separates first-party and third-party cookies, real examples of each, how Safari, Firefox and Chrome treat them in 2026, and why consent depends on purpose rather than domain.](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) [Read the article](https://www.flowconsent.com/en/blog/first-party-vs-third-party-cookies) ## Make your site compliant today. Free up to 25,000 sessions a month. No credit card, no commitment. [Create my banner](https://app.flowconsent.com/auth/sign-up?utm_source=flowconsent.com\&utm_medium=referral\&utm_campaign=general) · [Scan my site](https://www.flowconsent.com/en/scan)