Updated on October 9, 2026
You have a form that converts well. Leads arrive daily, and your sales team or call center calls them back. Then a prospect asks, "Where did I agree to be called?" And at that point, no one can remember which box was checked, the text displayed that day, or the time of submission. Since August 11, 2026, this oversight can cost a company up to €375,000. This guide shows you how to build a GDPR-compliant form where consent is valid under audit, without sacrificing your conversion rate.
In short: a GDPR-compliant form collects consent via a separate, unchecked box, distinct from the Terms and Conditions and specific to each use (email, phone, sharing with partners), with text identifying who will contact you and the purpose of the contact. For telephone marketing to individuals, prior consent has been mandatory since August 11, 2026; it expires after a maximum of one year, and proof of consent must be kept for three years. The entire process must be time-stamped and archived with the exact version of the displayed text.
The 4 criteria for valid consent in a form
Consent is only valid if it is freely given, specific, informed, and unambiguous, and it must remain revocable at any time. If even one of these criteria is missing, legally, you have not obtained consent.
In concrete terms, here is what each criterion requires of your form:
- Free : submitting the form should not depend on the marketing option. If the prospect cannot obtain their quote without agreeing to the marketing, consent is being forced.
- Specific : one box per purpose. “Receive the newsletter” and “Be called back by an advisor” are two separate consents.
- Enlightened : the text next to the box should state who processes the data, for what purpose, and how to unsubscribe. Tiny font or a link to a 4,000-word page is not sufficient.
- Unequivocal : a positive action is required. A pre-ticked box, silence, or simply continuing to browse does not constitute agreement.
One point that many forms miss: the consent box should never be confused with acceptance of the terms and conditions. The CNIL (French Data Protection Authority) reiterates this in its fact sheet on email prospecting : for an individual, a positive and specific action is required, typically a box unchecked by default.
And in B2B?
In B2B, email marketing can be based on legitimate interest if the message relates to the recipient's profession and they can easily opt out. The 2026 telephone opt-in scheme, however, targets consumers. An explicit opt-out option remains useful in B2B: it facilitates proof and reassures your legal department.
Telephone opt-in: what changes since August 11, 2026
Since August 11, 2026, it has been illegal to call a consumer for commercial purposes without their prior consent, except under a current contract for the same purpose. This represents the shift from opt-out (Bloctel) to opt-in, as stipulated by Law No. 2025-594 of June 30, 2025, and further defined by Decree No. 2026-662 of July 23, 2026.
For a lead generation form, the change is massive. Previously, calls were permitted as long as the number wasn't registered with Bloctel. Now, your form itself grants the right to call. Here's why.
According to the DGCCRF fact sheet for professionals, telephone consent must:
- result from a clear positive act: a pre-written statement that the consumer "acknowledges" without express agreement does not count;
- indicate the identity of the professional who will call and the purpose of the call (the goods or services concerned);
- have a maximum validity period of one year, without tacit renewal;
- to be proven: the professional archives the proof for at least three years and provides it to the consumer who requests it;
- to be able to be withdrawn as simply as it was given.
Penalties can reach up to €75,000 for an individual and €375,000 for a legal entity. Bloctel has been discontinued, and reports are now handled through SignalConso. According to Lemon squeezer, the platform received approximately 16,000 complaints in its first month, nearly double the usual average. Consumers are reporting the issues. Audits will follow.
The case of sectors under prohibition
For energy-efficient renovations, home adaptations, and the CPF (Personal Training Account), cold calling remains prohibited, except upon explicit request from the consumer. If you collect leads in these sectors, your form must explicitly reflect this request ("I would like to be contacted regarding my heat pump project"), not simply a passive acceptance. We detail this process in our guide to heat pump and solar panel eligibility form.
One question remains that the law does not clearly answer: what to do when a lead is passed on to several partners? We will come back to this in the section on the form template, because this is where most collection efforts break down.
Design errors that the CNIL penalizes
The CNIL (French Data Protection Authority) is less concerned with the absence of a checkbox than with interfaces that push users to accept: a giant "yes" button, a hidden "rejection" option in a gray link, or reduced text. Three recent decisions specifically target lead generation forms.
- Solocal Marketing Services, May 2025, €900,000 : acceptance buttons are highlighted by size, color, and position, while rejection buttons are minimized. Several million people are contacted via SMS and email using data from brokers and sweepstakes entries.
- Caloga, May 2025, €80,000 : prominent "accept" button versus a simple hyperlink to decline, inability to unsubscribe with a single click, and transmission of files to partners based on legitimate interest CNIL press release on Caloga details each shortcoming.
- Tagadamedia, December 2023, €75,000 (reduced to €50,000 by the administrative court in May 2026) : competition and product testing forms where the consent button contrasted with the refusal button, with incomplete text in small size.
The pattern is always the same. None of these companies had overlooked the box. They had all made refusal more difficult than acceptance.
The practical rule that follows from this is that the "no" choice must have the same visual weight as the "yes" choice. Same size, same contrast, same number of clicks.
Proving consent: the 8 data points to log
Proving consent means being able to show who agreed, what they agreed to, when, on which screen, and with what exact text. A simple "opt-in = yes" column in your CRM proves nothing.
The guides we analyzed in both France and the United States repeatedly state that you must "keep proof," without ever specifying what kind. Here is the list we recommend storing for each submission:
- Timestamp to the second, with time zone.
- Lead ID (email, phone) as entered.
- Full text of the consent displayed at that time, not a link to the current version.
- Form version (number or date of modification), to find the exact layout.
- Page URL and a source of traffic.
- IP address and user agent, as technical indicators.
- Value of each cell : checked, unchecked, not displayed (conditional logic).
- Expiration date : submission + 12 months for the phone, and withdrawal history.
Point 3 is the one that's most often missing. If you change the wording of the field in March, the leads from January must remain linked to the old wording. Otherwise, you won't be able to provide the consumer with the proof that the DGCCRF (French Directorate General for Competition Policy, Consumer Affairs and Fraud Control) requires.
Point 8 has operational consequences. A phone consent form dated September 15, 2026, no longer authorizes any calls after September 15, 2027. Your CRM needs to know this. If your leads are being sent to HubSpot or Salesforce, forward these fields with the contact information: see our article on this topic integrating a form with HubSpot or Salesforce shows how to map custom fields.
GDPR consent form template, ready to customize
A compliant lead form contains three sections: the necessary fields, separate consent boxes for each channel, and a short information notice with a link to the full policy. Here's a template to adapt.
Block 1, fields: only those you need to process the request. The principle of minimization here intersects with conversion: every superfluous field slows down completion. Our method for increase your form conversion rates by 40% return to this point.
Block 2, consents (all unchecked by default):
- ☐ “I agree to be contacted by [Company Name] regarding [specific subject, e.g., my mortgage application] for a maximum of 12 months.”
- ☐ “I agree to receive offers by email from [Company Name] on [topic].”
- ☐ “I agree that my contact details may be shared with [named list of partners or link to this list] to be contacted regarding [subject].”
And that's not all. Regarding the transfer of data to partners, remember Caloga: legitimate interest wasn't enough. If a lead goes to three brokers, each broker must be able to demonstrate consent that specifically names them or refers to a precise and up-to-date list. A generic "our partners" is no longer acceptable.
Block 3, information statement: the data controller, purpose, retention period, rights (access, rectification, objection, withdrawal) and contact information for exercising these rights. Three lines and a link are sufficient.
Want to take the structure further? Multi-step forms allow you to place consent at the final stage, when the prospect's engagement is strongest. You'll find examples in our selection of multi-step quote forms.
Conformity and conversion: why they are not opposed
A well-designed GDPR form doesn't necessarily lower conversion rates; what does is a poorly placed mandatory field or confusing legal jargon. Compliance is primarily costly in terms of the volume of "fake" leads—those who never actually requested a callback.
Let's take a common example from lending or real estate. A form with a pre-checked box generates 1,000 leads per month, but the call center contacts only a small portion of them because many people don't remember requesting anything. The version with an explicit checkbox produces fewer submissions. People who check the box wait for the call. The cost per lead increases, and the cost per appointment decreases. This is the metric to track, not the raw volume.
Three levers limit friction:
- Conditional logic : only display the "call" option if the prospect has chosen "request a callback" as their contact method. Fewer options, greater clarity. See our guide to conditional logic.
- A human text The statement "An advisor will call you within 24 hours about your project" is more reassuring than a paragraph on Article 6 of the GDPR.
- The A/B test : the wording and placement of the boxes are tested like any other element. Our recommendations for lower the cost per unit (CPL) of your forms also apply here.
What Blastform brings to the table regarding consent traceability
Blastform is designed for lead generation, with GDPR compliance built into the builder rather than added as an afterthought. The goal: that every lead arrives with their consent and proof of it.
In practice, this translates into configurable consent boxes that are unchecked by default, display conditions based on responses, and lead generation via your tools with the fields your teams need. The "GDPR Compliant" section of our Blastform features details what is included, and the Blastform help base explains the setup step by step.
Do you work in a sensitive sector like credit, where every lead called must be impeccable? Our dedicated page for credit lead forms presents suitable models.
The easiest way is to check on your own forms. Book a Blastform demo : we review with you an existing form and its consents, or compare the offers and start the trial.
Frequently Asked Questions
Can a consent box be mandatory to submit the form?
No, not for marketing purposes: if submitting the form depends on accepting marketing communications, consent is no longer freely given. However, you can make a field mandatory that is related to processing the request itself, for example, consent to be contacted regarding the requested quote.
Is a pre-checked box valid if the user can uncheck it?
No. The Court of Justice of the European Union, the CNIL (French Data Protection Authority), and the decree of July 23, 2026, on telephone marketing all agree: only a positive action by the user constitutes consent. A pre-ticked box, even if uncheckable, does not constitute consent.
Is telephone consent obtained before August 11, 2026 still valid?
Only if it meets the new requirements: a clear affirmative action, the professional's identity and the purpose of the call stated, and proof retained. Since its validity is capped at one year, old and vague consent is considered expired; it is best to obtain it again.
Should each partner be named in the form?
The calling partner must be able to provide proof of consent that identifies them. In practice, name the partners in the text or refer to a specific, dated list accessible from the form. A generic phrase like "our partners" exposes you to penalties, as demonstrated by the Caloga decision.
How long should proof of consent be kept?
For telemarketing, data must be kept for at least three years according to the DGCCRF (French Directorate General for Competition Policy, Consumer Affairs and Fraud Control), even after consent has expired. Retain the timestamp, the exact text displayed, the version of the form, and the withdrawal history.