A privacy notice and consent on a site

A privacy notice is a public document saying what is done with visitors’ data. Consent is a person’s own action, with a text of its own.

Two documents, two purposes

Out of the record in the last lesson grow two texts, and they must not be confused.

• A privacy notice (in the US, usually a “privacy policy”) is a public document of description. It answers “who are you, what do you do with the data, why, how long do you keep it, who do you pass it to, and how can a person use their rights?” Everyone reads it, including people who have sent nothing, and the authorities. The GDPR (Articles 12 to 14) requires the information to be given in a concise, transparent, intelligible and easily accessible form, in clear and plain language, at the time the data is collected. In California, the California Online Privacy Protection Act (CalOPPA, Business and Professions Code § 22575) requires an operator of a commercial website that collects personal information from Californians to conspicuously post its privacy policy, and the CCPA adds a notice at collection for businesses it covers.
• Consent is a person’s action: an empty checkbox that they check themselves, under a text that says what they agree to. Under the GDPR it must be distinguishable from other matters (Article 7(2)). It belongs to the person and is kept as a record.

The lesson on legal texts taught you to write them clearly, in two layers: short at the top, detailed below. Here you add what makes the notice complete.

The notice: ten sections

The law doesn’t dictate an exact form for a notice, but by its sense it must show a person what happens to their data. Article 13 of the GDPR lists what has to be said: the controller’s identity and contacts, the purposes and the legal basis, the recipients, any transfer to another country, the retention period, the person’s rights, the right to withdraw consent, the right to complain to a supervisory authority, and whether giving the data is required. A reliable structure that you fill in from your record:

1. Controller. A name, a city, how to contact you about data (an email). For a company: the full name and address.
2. What data. A concrete list: name, phone, the text of a message. If there is an analytics counter, say what it collects.
3. Purposes. For each group of data, a purpose of its own in your own words (“reply to the inquiry”), not “for marketing purposes.”
4. Lawful basis. Consent, contract, legal obligation, legitimate interests: what you wrote in the record.
5. Retention. As a number and with a condition for deletion: “three years after the last contact, then we delete it.”
6. Who receives the data. The host, the email service, the CRM, the payment service, the counter: every recipient from the record. A transfer to another country is named separately, with the safeguard you rely on.
7. Where it is stored and how it is protected. The country or region, and briefly: HTTPS, access by role, a second factor, backups.
8. The person’s rights. To find out, correct, delete, withdraw consent, complain to the authority (in the UK, the ICO; in the EU, the national data protection authority); an email for requests; the time to answer (one month under the GDPR; for California requests under the CCPA, 45 days).
9. Cookies and counters. What the site sets, why, and how to refuse (in detail in the next lesson).
10. Version and changes. A date, a version number and what changed; earlier versions are kept.

Rules that are easy to break.

• The notice tells the truth, that is, it describes your real practice (the rule from the lesson on legal texts). The commonest mistake is another site’s notice with your name on it. You may copy the structure; you write the content from your own record. A generator or a model gives only a draft. A new service appears in the notice before it appears on the site. In the US this matters twice over: a policy that misdescribes what you do can be treated by the Federal Trade Commission as a deceptive practice (the lesson on advertising law returns to this).
• The notice is accessible. An ordinary page of the site (HTML), not only a PDF in a closed customer area; a link beside the form and in the footer of every page. An ordinary page reads on a phone and with a screen reader.
• The notice is understandable. Two layers, as above: a short summary, then the full text. Use the language your visitors read.
• The notice has a date and a version, so that you can say which text applied when a person agreed. Every version is kept.
• Languages. If the site has two versions (English and Russian, say), state in the notice which text prevails. Legal text is better translated by a person than by a machine: an unnoticed mistake in a word such as “may” or “must” changes the sense.

Consent: markup and record

Now you will see five ways to write a consent line under a form. Three of them don’t work, and it matters to see why.

consents(request_id, given_at, text_version, purpose)
→ 4821, 2026-10-28 12:41, “v3”, “answer the inquiry”

A proper consent in markup looks like this:

<label>
  <input type="checkbox" name="consent" required>
  I agree that Sam Carter will process my name and phone number
  in order to reply to my inquiry. <a href="#privacy">Privacy notice</a>
</label>
<label>
  <input type="checkbox" name="newsletter">
  I would like to receive news by email
</label>

A note on honesty before the details. A required consent checkbox on an inquiry form is a simplification we use to practice the markup. Regulators point out that consent is the right basis only when the person has a real choice. If you need the details to answer the inquiry at all, the honest basis is usually the “steps at the person’s request before a contract” or legitimate interests (see the last lesson), and then you don’t need the checkbox: you put a short line and a link to the notice beside the button instead. Consent is the right tool where the person can truly say no without losing the service: a newsletter, a callback about other offers, non-essential cookies. What follows is how consent must be built whenever you do use it.

• An empty checkbox. No checked. The person checks it.
• Separate purposes, separate checkbox. A newsletter is optional and separate, because it is a different purpose (the rules on email marketing are in the email lesson). Under Article 7(4), when you judge whether consent is freely given, you must take account of whether a service is made conditional on consent to processing that isn’t necessary for it.
• A text of its own. It has no terms of sale, no user agreement and no other documents. It has the controller, the data, the purpose and a link to the notice. If your text is long, with a list of actions and periods, put it on a separate page with a link next to the checkbox.
• The link to the notice opens in a new tab or in a clear place, so that the person doesn’t lose the form they filled in.
• A record of the consent: the date and time, the version of the text, the purpose, and the link to the inquiry (Article 7(1): you must be able to demonstrate it). Then you can tell the person what they accepted and when, and show it to a regulator. If the person withdrew consent, that is a record too.
• Withdrawal. It must be as easy as giving consent (Article 7(3)): an email to the address in the notice is the minimum, and for a newsletter a one-click unsubscribe link. On receiving a withdrawal you stop the processing that rests on it, and delete the data unless another basis lets you keep it.

Then the exceptions. Consent is not needed where the processing rests on another basis, such as a contract or a legal duty. And children have special rules: under the GDPR a child’s own consent to an online service is valid from 16, and member states may lower the age to no less than 13 (Article 8); the UK sets it at 13; and in the US the Children’s Online Privacy Protection Rule (COPPA, 16 CFR Part 312) requires verifiable parental consent before collecting personal information from a child under 13 on a site directed to children or with actual knowledge. If your site is aimed at young people, take advice.

What these texts never contain

• “By pressing the button you agree.” Pressing a button sends a form. It is not a clear affirmative action expressing consent.
• Consent to “any processing by any means.” It isn’t specific.
• Consent inside terms of sale or a user agreement. It isn’t distinguishable.
• A notice that doesn’t mention the counters and services that are on the site.
• A link to a notice that doesn’t open, and a notice with no date.
• Demanding consent where none is called for: for example, to view the site.

Practice

You are in the era of 2014: a form has appeared on the site, and it is time to put it in legal order. You get a form with a pre-checked box bundled with terms that shouldn’t be there, and a frame of a notice with no text. Fix the consent, add the newsletter as a separate checkbox, add a link in the footer and fill in the ten sections of the notice from your own record in the last lesson.

The check reads structure: an empty required checkbox without the word “terms,” a controller, a purpose and a link; a separate newsletter checkbox; ten sections with the needed words and a date. Whether the notice is good in substance is for a lawyer to decide: before you publish it, show it to one, as we said in the lesson on legal texts.

What used to be different

Consent used to be a line of small print at the foot of the page, or a button that “itself” sent the form. A notice was a copy from the internet, thirty pages long in legal language, and nobody, the owner included, read it. Today the requirements for consent are stricter, and the value of openness is clear even without a law: a person who has been honestly told what happens to their data trusts you more and more often sends the inquiry.