Website consent Website consent should make each choice clear and keep proof of what the user agreed to.
One input box, several different jobs, and only some of them are marketing. It may deliver a receipt, answer an enquiry, create an account or add somebody to marketing. Problems begin when one vague checkbox is expected to authorise all of them.
Map each message before designing the form. This article provides operational guidance, not a legal opinion. Organisations should assess their audience, message and circumstances against current ICO guidance.
Separate service messages from marketing
A message needed to provide a requested service is not automatically marketing. An order confirmation can give delivery facts without promoting another product. Adding a sales offer changes the character of the content and may bring electronic marketing rules into the decision.
Label website choices by purpose. “Send my quotation” describes the immediate request. A separate choice can invite product news or useful guidance. Do not make optional marketing permission a condition of receiving a quote unless there is a sound and transparent reason.
Know which recipient you are contacting
ICO guidance treats individuals, sole traders and some partnerships differently from corporate subscribers under the electronic mail rules. Marketing to an individual generally needs specific consent or a valid soft opt-in. Corporate bodies can be approached without that PECR consent. However, the sender must identify itself and provide a valid opt-out address.
Personal data rules still apply when a named business contact is involved. A work email address containing a person’s name is personal information. Record the lawful basis, be fair and make the privacy information available.
Use consent that can be understood and proved
Consent should be a clear positive action, specific to the channel and purpose. Leave optional boxes unticked. Name the organisation sending the messages and avoid bundling unrelated companies into an open-ended statement.
The database needs more than a yes or no value. Keep the wording shown, time, source form, channel and account or record linked to the action. If the wording changes, preserve the version that applied when the choice was made.
Apply the soft opt-in narrowly
The soft opt-in is not general permission to email anybody who entered an address. ICO guidance limits it to the organisation’s own customers, or people in genuine sale negotiations, for similar products and services. An opt-out must be offered when details are collected and in every later message.
A request for general information does not necessarily amount to negotiation for a sale. Document why the rule applies to the route rather than adding every contact-form enquiry to a campaign automatically.
Make unsubscribing work end to end
Every marketing email needs a simple way to object. The link should not require an account password or a long survey. Process the request promptly across all relevant marketing tools, not only the list that sent the last campaign.
Keep a minimal suppression record so the address is not imported again later. Suppression is different from deleting every trace of the request. enough information may need to remain to respect the objection.
Review purchased and shared lists carefully
A supplier’s assurance that a list is “GDPR compliant” does not prove permission covers your organisation, purpose and email channel. Obtain the collection wording, source, date and method. If those details cannot demonstrate appropriate permission, do not use the list.
Take the same care when moving contacts between group companies, partners or platforms. A technical export does not expand what people were told or what they agreed to receive.
Test the complete website flow
- Submit with the marketing choice left blank.
- Submit with it selected and inspect the stored evidence.
- Confirm the promised welcome or double-check message arrives.
- Use the unsubscribe link and verify future sends are suppressed.
- Check that failed form submissions do not create consent records.
- Confirm staff can find and apply an objection received by phone.
Review third-party form, CRM and email permissions as part of the test. Each integration should receive only the fields needed for its stated role, with access limited to people who use them.
Give the record an owner
Name the person responsible for form wording, audience rules, suppression and periodic review. Campaign activity can move quickly. an owned decision record prevents a convenient data import from quietly changing the permission model.
Sorting one list
A wedding photographer has 2,300 addresses in one list and wants to send a seasonal offer. Splitting the list by how each address arrived changes what she can lawfully send.
About 900 came from a newsletter box with a clear description of what would be sent: straightforward consent. Roughly 700 are past clients who booked and paid. the offer is for the same kind of service. the soft opt-in applies provided every previous email carried a working unsubscribe. Around 400 came from a prize-draw entry form where the marketing consent was pre-ticked, which is not consent. The remaining 300 are business addresses collected at wedding fairs, which need checking one at a time, because a sole trader’s address is treated like an individual’s.
The offer goes to 1,600 people. The other 700 get a single re-permission email or nothing at all.
Sources and further reading
- ICO guidance on complying with electronic mail marketing rules — the source for consent, the soft opt-in and list checks.
- ICO direct marketing advice for small organisations — the reference for individual and corporate contacts, identity and opt-out duties.
We can connect forms, consent evidence and campaign systems through its digital marketing and automation services.
Quick website consent action plan
- Separate service mail from marketing. Write down the result. Name one owner.
- Use clear labels near each choice. Test this step. Keep proof of the test.
- Do not pre-tick the box. Use real data. Check each fact.
- Link the right privacy details. Ask one user. Note what feels hard.
- Save time and wording with consent. Fix each fault. Run the check again.
- Make opt-out easy to use. Set a due date. Review the result.
- Test tags before consent. Write down the result. Name one owner.
- Review all tools and forms often. Test this step. Keep proof of the test.
- Choose one clear goal. Use real data. Check each fact.
- Name the owner for each task. Ask one user. Note what feels hard.
- Test the full path before launch. Fix each fault. Run the check again.
- Set the next review date. Set a due date. Review the result.
- Keep the plan where staff can find it. Write down the result. Name one owner.
- Use plain words in each note. Test this step. Keep proof of the test.
- Save proof for each key check. Use real data. Check each fact.
- Fix one issue at a time. Ask one user. Note what feels hard.
- Check the result with a real user. Fix each fault. Run the check again.
- Remove work that does not help the goal. Set a due date. Review the result.
- Share each major change with the team. Write down the result. Name one owner.
- Run the same checks after each update. Test this step. Keep proof of the test.
- Check the source of every key fact. Use real data. Check each fact.
- Keep private data out of public notes. Ask one user. Note what feels hard.
- Plan what to do when a check fails. Fix each fault. Run the check again.
- Give each choice a clear reason. Set a due date. Review the result.
- Keep old files until new work is proven. Write down the result. Name one owner.
- Ask for help when the risk is high. Test this step. Keep proof of the test.
- Check phone and desktop views. Use real data. Check each fact.
- Make the next step easy to find. Ask one user. Note what feels hard.
- Track the result that matters most. Fix each fault. Run the check again.
- Close each task when proof is saved. Set a due date. Review the result.
Use this website consent plan as a live check. Keep the notes short. Review the work after each major change.
