A consent field on a registration form should ask for one specific thing, start unticked, sit apart from your terms, and be optional unless the event genuinely cannot run without it. Registering for a conference is not consent to marketing, so ask separately, record the answer, and make it as easy to withdraw as it was to give.
What Is a Consent Field, and What Is It Not?
A consent field is a question where the delegate says yes or no to one defined use of their data that the event does not strictly need. Newsletter sign-up, sharing details with sponsors, filming at the gala dinner: those are consent questions. Accepting your terms and conditions is a different thing, and so is giving your name to get a badge.
The distinction matters because most of what a registration form collects does not rely on consent at all. Name, email and ticket type are needed to run the event, so the lawful basis is the contract with the delegate, not a tick box. Pile consent boxes on top of that and you create a second problem: a form that asks permission for things you were going to do anyway, and then cannot honour a "no".
The UK regulator is plain about the standard. The ICO says that silence, pre-ticked boxes or inactivity do not constitute consent, that consent should be kept separate from other terms, and that separate consent is needed for different purposes wherever appropriate. This article is general information, not legal advice, and your own data protection lead or adviser has the last word.
Which Consent Fields Does a Conference Registration Form Actually Need?
Most in-person events need two or three, and many need only one. Work through this list and delete anything you cannot connect to a real use.
Marketing About Future Events
This is the one almost every organiser wants. Ask it as its own question: "Send me news about next year's congress by email." Leave it unticked. Do not tuck it into the sentence that says "I agree to the terms". If the delegate says no, they still register, and you still send the confirmation, the joining instructions and the one email about the venue changing. Those are service messages, not marketing.
Sharing Details with Sponsors or Exhibitors
Treat this as a separate question from your own marketing, because it is a different recipient and a different purpose. Say who receives the details, which details, and for what. "Share my name, job title and company with the sponsors of the sessions I attend" is a question a delegate can answer. "Share my details with our partners" is not.
Photography and Filming
Photography at an event often rests on a notice at the entrance rather than a tick box, but when you plan close-up filming of speakers, delegates on stage, or testimonials, ask for it. A speaker form can carry a consent line for filming, and a delegate form can carry a separate one for being photographed in the Q&A queue. Keep the two apart, because a speaker agreeing to be filmed says nothing about the person in row nine.
Directory or Attendee List Visibility
If delegates can see each other in a directory or find each other in the event app, ask whether they want to be listed. Make the default the private option. People who did not expect to be searchable by name and company tend to notice, and they notice loudly.
Special Category Data
Dietary needs and access requirements can reveal health or religious belief. Ask only what the catering and the venue need, explain what it is used for, and keep the answers out of anything exhibitors or sponsors can see. Our piece on attendee data and retention covers how long you should hold it.
What Should You Never Pre-tick or Bundle?
Never pre-tick anything, and never bundle a consent into the terms. Those are the two mistakes that regulators and complaint handlers keep finding on event forms, and both are easy to avoid.
Bundling is the sneakier one. A single box reading "I agree to the terms and to receive marketing from the organiser and its partners" feels efficient. It fails the test on every count: it combines purposes, it names no recipient, and it makes registration depend on a consent the event does not need. Article 7 of the UK and EU GDPR asks the controller to be able to demonstrate that consent was given, to make the request clearly distinguishable from other matters, and to make withdrawal as easy as giving it. A bundled box cannot do any of that.
The same article tells you to look at whether a contract depends on consent to something the contract does not need. If a delegate cannot buy a ticket without ticking "share my details with sponsors", the consent is unlikely to be freely given. Make those boxes optional and let the sponsor-facing data follow the answer.
Conference Registration Without the Procurement Saga.
Delegate types, early-bird windows, session booking, badges designed in millimetres and check-in from any phone, with no limit on delegates.
| Form Pattern | Starts Unticked | One Purpose per Box | Registration Depends on It | Usable as Consent |
|---|---|---|---|---|
| Pre-ticked marketing box | No | Varies | No | No: pre-ticked boxes are not consent (ICO) |
| Marketing wording inside the terms checkbox | Varies | No | Yes | No: bundled and conditional (ICO, Article 7) |
| Required "share with sponsors" box | Yes | Yes | Yes | Doubtful: conditional on something the event does not need |
| Separate optional box for each purpose | Yes | Yes | No | Yes, provided you record it and honour withdrawal |
Table sources: ICO guidance on valid consent and Article 7 of the GDPR, linked above, as read on 8 November 2026.
How Do You Build This on a Registration Form?
You build it as ordinary questions: one for each purpose, each optional, each worded for a single use. In eventcloud the form builder offers text, dropdown, single and multiple choice, date, time, country, phone and address fields, a Terms agreement question, section headings and page breaks. A purpose-specific consent is a single choice or multiple choice question you write yourself. Put the consent questions on their own page or under their own heading so they read as a decision, not small print.
Because each ticket group has its own form, you can ask different things of different people. A speaker form can carry the filming consent. A delegate form can carry the directory question. A visitor form for the free exhibition can stay short and carry only the marketing question. The answers flow to the attendee list and the Excel export, matched by question, so renaming or translating a question never breaks the link. That is what makes the record useful when someone asks, six months later, what they agreed to.
Two practical details. First, keep the consent question labels stable once registration opens; if the wording changes, note the date of the change so you know which version each person saw. Second, delegates can correct their own answers through the attendee portal, but not their email address or their Terms answer, so decide the consent wording before you open the doors. The registration features page shows the field types and ticket groups in more detail.
How Does Withdrawal Work Once the Event Has Started?
Withdrawal has to be as easy as consent was, so decide the route before you launch. For marketing, that is an unsubscribe link in every email you send plus a named address for replies. For sponsor sharing, it means a person who writes to you stops being included in the next data release, and you need a process to make that happen.
Keep a simple log of requests, who handled them and when. If a delegate asks you to erase their registration altogether, eventcloud lets you erase an attendee on request, and erasure also deletes any leads that exhibitors captured by scanning them. Tell the exhibitor team that rule in your exhibitor manual so nobody is surprised when a list gets shorter.
What About Badge Scanning and Lead Retrieval?
Scanning is where consent questions meet the show floor. Exhibitors scan attendees with their own phones, reading the QR code on each attendee's badge or in their event app. A scan shares a record with that exhibitor. It is not consent to marketing, and it should never be described to attendees as if it were.
So decide what a scan shares, say so on the registration form and the badge notice, and keep the marketing question separate. A delegate who ticks "email me about next year" has told you something about your emails. They have said nothing about the stand they stopped at in hall two. Our article on why a scan is not consent under GDPR and PECR sets out what an exhibitor can and cannot do with a scanned lead.
A Short Checklist Before You Publish the Form
Read the form as a delegate would, on a phone, with no context. Count the boxes. For each one, can you say in a sentence who gets the data and why? Is it unticked? Can the person say no and still register? Is the wording different from your terms? Can you find the answer in your export later?
If your event has a consent need that does not fit the fields above, such as a member-only data sharing agreement or a country-specific notice, tell us how your registration works at our contact page. Then run one test registration per ticket group, tick nothing, and check that everything you promised still arrives.
