The GDPR consent checkbox: when it's required, when it's pointless

Under almost every French landing page form, the same box waits for the visitor: "I accept the privacy policy." The instinct is understandable — faced with the GDPR, adding a checkbox feels like the safest move. The problem is twofold: a ticked box does not create compliance, and an unnecessary box costs conversions while distracting from the one thing that really is mandatory in every case: clearly informing people at the moment they hand over their data. One essential caveat before going further: this article is informational, not legal advice. In France the CNIL is the reference, and a lawyer's analysis is needed as soon as the stakes are serious.

Three separate obligations rolled into one checkbox

Most misplaced checkboxes come from the same misunderstanding: believing there's a general duty to make people "accept" something. In reality three different questions are at play, and only one of the three is sometimes answered by a checkbox. The first is the legal basis: on what grounds are you allowed to process this data? The second is the duty to inform: does the person know who is collecting, why, for how long, and with what rights? It applies in every case, and it isn't ticked — it's displayed. The third is consent to commercial prospecting: on top of handling the request, do you want to send marketing messages later? That's where — and essentially only where — a checkbox belongs. Confusing the three produces the classic case: a quote request form that blocks submission until the visitor has "accepted the privacy policy," even though that processing doesn't rest on consent at all — and which never says how long the data will be kept. The general framework is covered in the article on the GDPR-compliant landing page form.

What the GDPR actually requires: a legal basis, not necessarily consent

Every processing operation must rest on a legal basis, and the CNIL lists six: consent, performance of a contract, compliance with a legal obligation, a public interest task, legitimate interest, and protection of vital interests. Consent is therefore one basis among several, and rarely the most relevant one for a commercial form. When a visitor asks for a quote, a callback, or a viewing, they are initiating a relationship themselves: handling their request naturally falls under a contract or pre-contractual steps taken at their request, sometimes under legitimate interest for a plain contact form. Making them tick a box adds no protection in that case, and even creates an inconsistency: consent can be withdrawn at any time, while their request needs to be seen through. What never goes away is the duty to inform at the point of collection, set out in Article 13 of the GDPR when data is collected from the person: the controller's identity, the purposes and legal basis, the recipients, the retention period, the person's rights and the right to lodge a complaint with a supervisory authority. In practice: two or three lines under the submit button and a link to an up-to-date privacy policy. That's more useful than a checkbox, and it means answering questions that are often dodged — the data retention period for a form and the legal notices and terms of sale a landing page needs.

When the checkbox really is necessary

• Newsletter sign-up — the textbook case for consent: the person agrees to messages they didn't ask for one by one. The box must be dedicated, unticked by default, and separate from any other commitment; email confirmation is covered in the article on double opt-in vs. single opt-in.
• Email or SMS prospecting to a consumer — the CNIL points out that electronic advertising in principle requires consent collected before the approach, with exceptions notably for existing customers contacted about similar products or services.
• Adding someone to a mailing list after a quote request — two different purposes, so a separate box for the second one, and refusing it must never block the form from being submitted.
• Sharing data with partners — as soon as the data serves a third party's prospecting, consent must be specific and the recipients identifiable by the person.
• What doesn't belong in the form's checkbox — trackers follow a separate regime with their own interface, covered in the article on the cookie banner and conversion and, to avoid them altogether, the one on cookieless analytics.

The B2B case in France: what the CNIL says

This is the most misunderstood point, and the one where caution matters most. The CNIL states that email prospecting in a professional context can rest on the organisation's legitimate interest when the subject of the approach relates to the profession of the person being contacted — the example it gives is software pitched to a company's IT director. Prior consent is then not systematically required, provided the person is informed of where their data came from and of the purpose of the message, and can object simply and free of charge, including at the point of collection. The CNIL also specifies that generic addresses such as contact@company.fr or info@company.fr, which relate to legal entities, are not subject to these principles. Three nuances matter: a named work address is still personal data; legitimate interest requires a documented balancing test against people's rights, it can't simply be asserted; and an approach unrelated to the recipient's role falls outside the framework described. On a B2B form, the practical consequence is that an "I agree to receive offers" box isn't always mandatory, but a visible way to refuse is. The acquisition side is developed in the article on the cold email landing page for B2B prospecting. Here too, this reading does not replace a lawyer's analysis of your specific situation.

How to word the notice: six practical rules

1. One box, one purpose. Consent must be specific: the CNIL rejects bundled consent that mixes several processing operations into a single tick.
2. Never pre-ticked. A box that's already filled in is not an unambiguous expression of will, and neither are silence or inaction; the topic is developed in the article on the pre-checked box on a form.
3. Say what the person will receive. "I accept the privacy policy" informs about nothing; "I'd like to receive the monthly letter on rental property, roughly one email a month" describes a subject, a frequency, and a content.
4. Announce withdrawal in the same sentence. Consent can be withdrawn at any time, by a means as simple as the one used to give it: "one-click unsubscribe in every email" is a compliance sentence and, incidentally, a conversion argument.
5. Don't gate submission on an optional box. If refusing the newsletter blocks the quote request, consent is no longer freely given; the distinction is covered in the article on required vs. optional fields.
6. Improve the microcopy rather than multiply it. Two readable lines under the button beat an unreadable legal wall; the writing principles are detailed in the article on form microcopy.

The effect on conversion: what the research shows

Research on consent interfaces, built mostly around cookie banners, transfers reasonably well to form checkboxes: wording and design weigh far more than legal content. A study by Christine Utz, Martin Degeling, Sascha Fahl, Florian Schaub, and Thorsten Holz published in 2019 at the ACM CCS conference, "(Un)informed Consent: Studying GDPR Consent Notices in the Field", tested several notice variants on more than 80,000 unique visitors of a real website: the notice's position strongly changes the interaction rate, and a binary choice gets more acceptances than a mechanism asking for permission category by category. The authors conclude that small implementation decisions substantially change how people respond. A study by Midas Nouwens, Ilaria Liccardi, Michael Veale, David Karger, and Lalana Kagal presented in 2020 at the CHI conference, "Dark Patterns after the GDPR", analysed the five most widespread consent management platforms across the 10,000 most visited UK websites and found only 11.7% of implementations met the minimal requirements derived from European law.

These results invite you to flip the marketing instinct on its head. Since design alone is enough to push an acceptance rate up, a high rate proves nothing about genuine buy-in: a review by Alessandro Acquisti, Laura Brandimarte, and George Loewenstein published in 2015 in Science, "Privacy and human behavior in the age of information", shows that privacy preferences are uncertain, context-dependent, and malleable — hence sensitive to presentation. The commercial consequence is direct: consent extracted through a pre-ticked box, deliberately vague wording, or a buried refusal is legally fragile and economically poor. Addresses collected that way produce immediate unsubscribes, complaints, spam reports that damage sending reputation, and leads who don't remember ever talking to you. It's the logic described in the article on dark patterns on a landing page: what inflates a number in the short term destroys the quality of the list. An honest checkbox next to a short form — the subject of how many fields a form should have — gets fewer sign-ups and a list that opens your emails.

LanderKit templates (€89 each, €229 for the pack of 10) ship forms whose consent boxes and information notices are editable straight from the content, without touching the code, and unticked by default — notably on Newsletter Creator, where consent is the heart of the page, and Real Estate Lead, where the callback request and the marketing subscription stay two separate things. What's left is adapting the wording to your actual processing, and having the sensitive points reviewed by a lawyer.