---
title: "Build a GDPR consent form"
description: "Record an explicit consent choice with a versioned notice — and leave the legal decisions to counsel, not the form builder."
order: 7
type: "guide"
topic: "Use cases"
tags:
  - "consent"
  - "GDPR"
  - "privacy"
  - "audit context"
updated: "2026-07-15"
---

A consent form records the choice and context your organization has decided to request. Fillo provides the fields and the response record — it doesn't decide whether consent is the right legal basis, and it doesn't make a workflow compliant on its own.

## Record a clear choice and version

```ts
const consent = defineForm({
  id: "research-consent",
  title: "Research participation",
  description: "Review the privacy notice before choosing whether to participate.",
  pages: [{
    id: "consent",
    blocks: [
      { id: "email", kind: "email", label: "Email", required: true },
      {
        id: "agree",
        kind: "checkbox",
        label: "I agree to be contacted for this research study",
        required: true,
      },
      { id: "notice_version", kind: "hidden", label: "Notice version", defaultValue: "2026-07-14" },
      { id: "source", kind: "hidden", label: "Source", paramName: "source" },
    ],
  }],
  settings: { submitLabel: "Record my choice", successTitle: "Choice recorded" },
});
```

Put the actual privacy notice in nearby product content or a clearly named link. Don't pre-check the box, don't bundle unrelated purposes into one choice, and don't treat a hidden field as evidence that someone read a notice.

## Design withdrawal and retention

Decide how a person withdraws consent, which system receives the request, how it's matched, and how downstream copies get updated. Fillo currently keeps accepted responses until they're deleted or the workspace is — there's no configurable per-form retention period.

Have qualified counsel review the exact purpose, wording, identity evidence, age or regional requirements, retention, and withdrawal process for your organization.

## Test the evidence path

Check that an unchecked required box blocks submission, the notice version is stored, exports carry the expected timestamp and response ID, and deletion covers connected destinations as well as Fillo.

## Try it

[Start with a prompt](/start?from=guide-build-a-gdpr-consent-form) and your coding agent builds the first form, staged for your review — or [open the editor](/new).

## Related

- [Beta access example](/examples#beta-access): See a live opt-in control before swapping in counsel-approved copy.
- [Checkbox field](/docs/fields/checkbox): Configure a required explicit choice.
- [Data retention](/docs/data-retention): Understand current response and draft retention.
- [Security](/docs/security): Keep access to sensitive response data workspace-scoped.