GDPR-Compliant Email Sign-Up Forms: A Checklist
Your sign-up form is where email marketing compliance begins. Get it right, and every subscriber on your list is someone you can prove agreed to hear from you. Get it wrong, and the whole list may be built on consent that does not count. This checklist covers what a GDPR-compliant email sign-up form needs under UK and EU rules, field by field.
Key takeaways
- Consent must be freely given, specific, informed and unambiguous. Pre-ticked boxes never count.
- Keep marketing consent separate from your terms and conditions, and link to your privacy notice.
- Record who consented, when, how and what they were told, so you can prove it later.
- Double opt-in is good practice, though not legally required.
- Every email must include a simple, free way to unsubscribe.
Most small businesses collect email addresses in several places: a footer newsletter box, a pop-up offering a discount, a checkout page, a free guide download and perhaps a paper sheet at events. Each of those is a sign-up form, and each one needs to meet the same consent standard under UK GDPR, EU GDPR and the electronic marketing rules that sit beside them, such as the UK's PECR and each EU country's ePrivacy laws.
This checklist focuses on consent-based sign-ups, which is how you build a marketing list from people who have not bought from you. It is general information, not legal advice. Rules change, and some UK provisions under the Data (Use and Access) Act 2025 are being brought in over time, so check the ICO guidance (or your national supervisory authority in the EU) or a qualified adviser for your situation.
What GDPR consent actually requires
Under UK GDPR and EU GDPR, consent has a specific legal meaning. It must be:
- Freely given: people have a genuine choice. They can refuse without being penalized, and consent is not bundled with something unrelated.
- Specific: it covers clearly defined purposes and channels, such as "weekly offers by email".
- Informed: people know who you are, what you will send, and that they can withdraw at any time.
- Unambiguous: there is a clear affirmative action, such as ticking an empty box or submitting a form clearly labeled as a newsletter sign-up.
Withdrawing consent must be as easy as giving it. If signing up takes one click, unsubscribing should not take five.
Common mistake
Using a pre-ticked "Yes, send me offers" box at checkout. Silence, inactivity and pre-ticked boxes are not valid consent under GDPR. The person must take the action themselves.
The anatomy of a compliant sign-up form
Here is what each part of the form should do. Use it as a field-by-field review of every form on your website.
| Form element | What good looks like | What to avoid |
|---|---|---|
| Headline and description | States what people will get and how often | Vague promises like "stay in the loop" |
| Fields | Email address, plus only what you truly need | Mandatory phone, birthday or address fields |
| Consent checkbox | Unticked, with clear wording per channel | Pre-ticked boxes or one box for everything |
| Privacy notice | A link right next to the consent statement | A link buried in the site footer only |
| Withdrawal | "You can unsubscribe at any time" stated plainly | No mention of how to stop |
| Button | Clear label such as "Subscribe to offers" | A generic "Submit" on a mixed-purpose form |
Write consent wording people can understand
Good consent wording names your business, the channel and the type of content. For example: "Yes, I would like to receive weekly offers and new product news from Hartley Bakes by email. I can unsubscribe at any time." If you also want to send texts, add a separate checkbox for SMS. Consent for one channel does not cover another.
If you plan to share subscribers with partners, name each partner at the point of sign-up. Generic wording like "carefully selected third parties" is unlikely to be specific enough.
Ask only for what you need
Data minimization is a core GDPR principle. For a newsletter, an email address is usually enough. A first name for personalization is reasonable if optional. Asking for a phone number, date of birth or company size on a simple newsletter form needs a clear purpose, and those fields should normally be optional.
Pro tip
Mark optional fields clearly and explain why you ask. "Birthday (optional): we will send you a treat in your birthday month" makes the purpose obvious and keeps consent informed.
Discount pop-ups, gated downloads and bundled consent
Incentives are where "freely given" gets tricky. Offering a discount or free guide in exchange for joining your list is common, and regulators accept it in many cases, but the deal must be transparent.
- Be upfront: say clearly that claiming the discount or guide means joining your marketing list, and what that involves.
- Keep it proportionate: the reward should be reasonable, and the marketing should match what you described.
- Separate from terms: never hide marketing consent inside your terms and conditions or make it a condition of buying something unrelated.
- Check local rules: EU countries interpret incentives and the ePrivacy rules differently, so check the rules where your subscribers live.
Example
Imagine a small candle shop, Wickfield, shows a pop-up: "Get 10% off your first order. Join our email list for new scents and offers, about twice a month. Unsubscribe any time. See our privacy notice." Visitors type their email and click "Join and get my code". The purpose, frequency and opt-out are clear, and the action is affirmative. Compare that with a pop-up that says only "Enter your email to unlock a surprise", which tells people nothing about the marketing they are signing up for.
Keep records you can actually use
GDPR requires you to be able to demonstrate consent. If a subscriber complains, or a regulator asks, you need to show exactly what happened. For each subscriber, record:
- Who: the email address or other identifier of the person who consented.
- When: the date and time of sign-up and of any confirmation click.
- How: which form, page or channel they used, such as "footer form on homepage" or "event sign-up sheet".
- What they were told: the exact wording of the form and the privacy notice version at the time. Save a screenshot or copy each time you change the wording.
- Withdrawals: when and how they unsubscribed, so they stay suppressed.
Most email platforms log the sign-up time, source form and confirmation. Check what yours captures and export it periodically. For paper forms at events, keep the sheets or a scanned copy, and note the date and event.
Double opt-in: good practice, not a legal must
With double opt-in, a new subscriber receives a confirmation email and must click a link before they join your list. GDPR does not require it, but it brings real benefits:
Benefits of double opt-in
- Strong evidence that the address owner really signed up
- Fewer fake or mistyped addresses on your list
- Fewer spam complaints and better deliverability
- Protects people from being signed up by someone else
Trade-offs to manage
- Some people never click the confirmation link
- Confirmation emails can land in spam folders
- Needs a clear thank-you page explaining the next step
- Slightly more setup in your email platform
If you choose double opt-in, make the confirmation email short and clear, send it immediately, and tell people on the thank-you page to check their inbox.
Checkout forms and existing customers
Checkout is a special case. In the UK, PECR's soft opt-in can let you email existing customers about your own similar products without consent, as long as you offered a simple opt-out when you collected their details and in every message. In that case, your checkout should show a clear opt-out option rather than an opt-in. EU countries have similar but not identical rules. If you want to market anything outside the soft opt-in, or you are unsure, use a separate, unticked consent box at checkout instead. Our explainer on the soft opt-in covers the conditions in detail.
GDPR sign-up form checklist
- Form says what subscribers will get and roughly how often
- Only the email address is required; other fields optional and explained
- Consent boxes are unticked, with a separate box for each channel
- Consent wording names your business and any partners
- Privacy notice link sits next to the consent statement
- Marketing consent kept separate from terms and conditions
- Incentives explained clearly, with marketing described upfront
- Records kept of who, when, how and what they were told
- Old versions of form wording saved when you change it
- Double opt-in considered and set up if it suits you
- Easy, free unsubscribe in every email, with a suppression list
Frequently asked questions
Is entering an email address into a newsletter box enough for consent?
It can be, if the form is clearly and only for signing up to marketing, explains what people will receive, and links to your privacy notice. If the box serves another purpose too, such as downloading a guide or creating an account, a separate consent checkbox is safer.
Do I need to re-consent my old subscribers?
Only if you cannot show valid consent for them. If you have no record of how or when they signed up, or they signed up through a pre-ticked box, their consent may not meet GDPR standards. Review your records before deciding, and get advice for large lists.
Does consent expire?
GDPR does not set a fixed expiry, but consent should be refreshed when it no longer reflects what people expect. Many businesses stop emailing subscribers who have not engaged for a long time, or ask them to confirm they still want to hear from you.
Do US subscribers need the same form?
US federal email law (CAN-SPAM) does not require prior consent, but a single GDPR-standard form for everyone is simpler and keeps your list clean. Using one form also avoids mistakes when you cannot be sure where a subscriber lives.
Related reading
The bottom line
A compliant sign-up form is clear about what people get, uses unticked boxes, links to your privacy notice and keeps a record of every consent. These steps take an afternoon to set up, and they turn your email list into an asset you can defend rather than a liability.
Review every form on your site with the checklist above, save copies of your wording, and check the ICO guidance or your EU supervisory authority when rules change.
