Contact forms and GDPR: is consent always required?

A familiar contact-form question:
Imagine entering a shoe shop ready to buy, only to be told that the assistant cannot ask your size until you accept the privacy notice. That would feel unnecessary because the information is needed to respond to your request.

That would make little practical sense.

The legal basis for processing contact-form data depends on the purpose and circumstances. A request may involve steps towards a contract or, in other situations, a legitimate-interest assessment. Consent is only one possible basis and should not be selected automatically.

The underlying idea is often described as implied conduct:
A person can communicate intent through conduct rather than an explicit written statement. Whether that creates legal consequences depends on the facts and the applicable law.

Someone entering a shoe shop expects to share the information needed to receive help. A website enquiry can involve a similar expectation: the recipient needs relevant contact details and the message itself to provide a response.

Why, then, do so many forms require a checkbox stating that the sender
• consents to data processing for the response, or
• has read and accepts the privacy notice?

Is that checkbox necessary? Website owners sometimes use consent by default because it appears to be the safest option.
Consent creates its own obligations. It must be freely given, specific, informed and demonstrable, and the person must be able to withdraw it.

Those obligations make consent inappropriate as a catch-all solution. The controller should instead identify and document the legal basis that actually fits the purpose.

What does the GDPR provide?

Article 6 GDPR lists several legal bases for processing. Depending on the enquiry, the most relevant may include:

Article 6(1)(a): consent
Article 6(1)(b): performance of a contract or steps requested before entering into one
Article 6(1)(f): legitimate interests, subject to the required balancing test

Article 6(1)(a): consent

Special-category data under Article 9 GDPR requires particular care and may change the legal analysis. Examples can include forms handling health information, political or religious affiliation, or uploads containing sensitive material. The correct basis and safeguards should be assessed for the actual use case.

[1] See the cited publication from the Bavarian data-protection supervisory authority.

For an ordinary enquiry that does not involve special-category data, another Article 6 legal basis may be more appropriate than consent. This must still be assessed case by case.

Article 6(1)(b): performance of a contract or steps requested before entering into one

Article 6(1)(f): legitimate interests

Responding to a genuine enquiry may represent a legitimate interest of the website operator, provided the processing is necessary and the balancing test supports it.
The interests may often align: one person asks a question and expects an answer, while the organisation processes the information needed to respond. That does not remove the need to document the assessment and respect the person’s rights.

Keep privacy information separate from contractual terms

For many ordinary contact forms, a mandatory “I accept the privacy policy” checkbox may be unnecessary. A privacy notice provides information; it is not usually something a visitor must agree to as if it were a contract.

There is also a contractual reason to avoid confusing wording:
A mandatory acceptance box may make privacy information appear to be part of the contract, similar to terms and conditions. Those are different legal functions and should be presented clearly.

A 2018 decision by the Berlin Court of Appeal considered an online shop that required customers to accept a separate “data-protection agreement” during checkout. The court examined whether the wording effectively turned privacy provisions into contractual terms.

The decision illustrates why labels and presentation matter: an average customer may understand a mandatory acceptance statement as a contractual condition. Privacy information should not be drafted or displayed in a way that creates that confusion.
Keep informational notices and contractual terms clearly separated, and have the implementation reviewed when the legal basis is uncertain.

Conclusion

Practical essentials:

• Protect contact forms with properly configured HTTPS encryption and current security measures.
• Apply data minimisation by making only genuinely necessary fields mandatory. What is necessary depends on the request and context. For example, age is unlikely to be relevant to an enquiry about a refrigerator but may matter for an age-restricted product. Follow the principle “as much as necessary, as little as possible” and require only the information needed to handle the enquiry.
• Place an accessible link to the privacy notice near the form. For example: “Find out how we process personal data in our privacy notice.”
• The notice should explain what data is processed, for which purpose, by whom, on which legal basis and for how long it is retained.

Further information

Relevant sources include Article 6(1) GDPR and Recital 47 . The cited publication from the Bavarian supervisory authority provides additional context: https://www.lda.bayern.de/media/pm2018_15.pdf. Specialist commentary and qualified legal or data-protection advicecan help with cases that involve unusual data or purposes.

Legal notice

This article provides a general overview and reflects the author’s assessment. Laws, regulatory guidance and individual circumstances can change, so completeness and current accuracy are not guaranteed.

This content is general information, not legal advice, and cannot replace an assessment by a qualified lawyer or data-protection professional. No liability is accepted for decisions made solely on the basis of this article.