Consent notices on enquiry forms: name the recipient, keep the record

An enquiry is only as good as the person’s understanding of where it was going. If someone fills in a form believing they’re asking one business, and the details reach another, the enquiry is weak at best and a complaint at worst.

Privacy and marketing rules differ by country, sector and channel, and this article is not legal advice. But regulators in different places point in a similar direction, and a few habits make sense almost everywhere.

Name the business that receives the request

The person should be able to see, before they press send, which business will receive their details. “A local provider” or “our partners” is not a name.

The UK Information Commissioner’s Office, for example, lists “your organisation was not specifically named” among the signs that consent is not valid, alongside vague requests and pre-ticked boxes. Canada’s privacy regulator, in its guidelines on meaningful consent, asks organisations to emphasise key elements up front, including what information is collected, why, and with which parties it will be shared, rather than leaving them in a long policy.

Keep the reply separate from marketing

Agreeing to be contacted about a request is different from agreeing to receive marketing. A useful pattern:

• one required statement that the business may use the details to reply to this request
• a separate, optional, unticked box for marketing, if marketing is wanted at all

Bundling the two makes it harder to show that either was a real choice.

No pre-ticked boxes

If a box is ticked by default, the person didn’t choose it. The ICO’s guidance is direct that silence, pre-ticked boxes or inactivity should not count as consent. Leave boxes empty and let people act.

Store which notice the person saw

Wording changes over time. When a request is saved, store a version label for the notice that was shown, so that months later you can see exactly what the person agreed to. This costs one field in a database and resolves most “what did they actually see?” questions.

Say how to change their mind

Tell people how to withdraw consent or ask for their details to be removed, and make it easy. Both regulators cited here treat the ability to withdraw as part of consent being meaningful.

A short form review

1. Is your business named next to the submit button?
2. Is the reply statement separate from any marketing choice?
3. Are all boxes unticked by default?
4. Is a notice version stored with each request?
5. Does the linked privacy notice say who else processes the details, such as your hosting or email provider?
6. Have you checked the rules for your own country and sector, or asked someone qualified to?

Ring Side Leads treats consent as one of the seven checks in its lead standard: a request without a notice naming the client isn’t counted.

Sources

• ICO: What is valid consent?, checked 2026-10-19
• Office of the Privacy Commissioner of Canada: Guidelines for obtaining meaningful consent, checked 2026-10-19

General information, not legal advice. Rules and programmes change; check the sources before acting.

Next: Check market fit before you spend: demand, capacity, rules and a reason to say no