The guideline
Ask for consent with an affirmative action — an unticked checkbox or an equivalent control — never a pre-ticked box, an implied acceptance, or consent bundled into the act of submitting. Keep marketing consent separate from the consent needed to deliver what the reader asked for, and separate each purpose where purposes differ. Link the privacy policy from the point of collection and state in the form itself what the data will be used for and by whom, rather than only in the linked document. Make withdrawal as easy as giving, and record what was consented to and when.
Common failures
- The site does not offer an explicit privacy or GDPR consent mechanism with a linked policy when visitors submit personal information through forms or sign-ups. This leaves users uncertain about how their data will be stored, processed, or shared.
Where it applies
Where
Disciplines
Devices
Why it matters, how to fix it, and the research behind it
Rubric's full guide adds the reasoning, the fix and the sources for this check, and checks your client's pages against it and hundreds of others. Findings come back worst first.