How to write a consent form

To write a consent form, say who is asking and exactly what the person is agreeing to, explain the risks and choices in plain language, give every separate decision its own required tick, collect a signature and the date, and keep the signed record together with the version of the wording it applied to. That is the whole job. Everything below is about doing each of those well enough that the form still means something when somebody reads it two years from now.

What consent has to cover

The Office of the Australian Information Commissioner sets out four elements of consent, and they make a good test for any form. The person is adequately informed before they agree. They agree voluntarily. The consent is current and specific. And they have the capacity to understand and communicate it.

The European rule reads much the same from the other direction. Article 7 of the GDPR says a request for consent inside a document that covers other matters must be clearly distinguishable from them, in clear and plain language, and that it must be as easy to withdraw consent as to give it. Recital 32 adds that silence, pre-ticked boxes and inactivity are not consent.

For anything touching health, the Australian Commission on Safety and Quality in Health Care describes informed consent as agreement given voluntarily after accessible, accurate and relevant information about the benefits, risks and alternatives, and it lists doing nothing and watching and waiting among the alternatives. A tattoo studio is not a hospital, but the shape transfers well: say what could go wrong, say what the other options are, and let the person decide. None of this is legal advice, so check the rules for your own service.

The five sections of a consent form

Who and what. One heading that names the business and one sentence that names the activity. The tattoo consent form from a fictional Fitzroy studio opens with “Consent to tattoo” and an intro that says the form is completed on the studio tablet with the artist present, and that the client must be 18 and show photo ID. Before a single field, the client knows where they are and what the conditions are.

Eligibility and health. Ask what changes whether the activity can go ahead. The tattoo form asks for date of birth and a photo of an ID, then a required checklist of conditions such as diabetes, heart conditions and blood thinners that ends with a none option, so a healthy client can answer honestly instead of being trapped.

The decisions. This is the heart of the form. The tattoo example uses five separate required statements: the risks have been explained, the tattoo is permanent, aftercare will be followed, the client is not under the influence, and the client is 18 and the ID is theirs. Each is its own field, so the record shows five decisions rather than one vague agreement.

Optional permissions. Anything the activity does not depend on gets asked separately, as a question that can be answered no. The school excursion consent form gives parents three choices about photographs, from newsletter and website down to “Please do not photograph my child”.

Signature and record. A signature, the date and whoever explained the risks. The tattoo example closes with the client signature and the artist initials.

Wording that is clear

The OAIC says consent information should be written in plain English, without legal or industry jargon. In practice that means first person statements a person can read aloud and mean.

“I acknowledge the inherent risks associated with the procedure” asks the reader to decode it. “The risks above have been explained to me” is the same idea in words anyone signs comfortably. “I understand the tattoo is permanent” is better still, because it names the one consequence nobody can undo.

Put consequences in the statement, not in small print. The swim school registration form has an emergency treatment authority that reads, in effect, that staff may arrange an ambulance or medical treatment and the parent accepts the cost. The cost is in the sentence being agreed to, where it cannot be missed.

Keep each consent apart from the terms and conditions. The background check consent form goes further and says in its intro that it is a separate document from the application on purpose, and that a check the candidate declines is not run at all. That one sentence does more for voluntariness than a paragraph of legal wording would.

Signature and date

An inline signature is drawn or typed by the person filling in the form and prints into the PDF of their response, with a Date line underneath it. For most consent forms, where the person signing is the person in front of you, that is enough.

When somebody else has to sign after the form is submitted, such as a parent who was not at the counter or a manager who approves, use an e-signature field instead. The signer gets an email link, signs in a separate portal, and the finished document comes back with an audit trail. The sibling post on collecting signatures sets out what each kind records, so it is not repeated here. The note on consent to electronic signature explains the separate agreement a signer gives to sign electronically at all.

For children, name the signer in the label. “Signed by the parent or carer” leaves no doubt about who was meant to hold the pen.

Storing it

A consent is only as good as your ability to show what was agreed. Three things make that possible.

Keep the wording with the answer. When you publish a form, a new version is written, and each historical version stays available at its own address. A response records the answers, which version they were given against and the time it was submitted. If you change the risk statement in March, February’s clients still agreed to February’s words, and you can show them.

Say who can see it. The tattoo form’s photo ID field carries a line saying the photo is kept with this consent only. That is a promise about storage, made at the point of collection, which is where it belongs.

Say how to withdraw. Give a contact and a plain sentence on what withdrawing changes. Consent that can only be withdrawn by a formal letter is not as easy to withdraw as it was to give.

A checklist you can work through

The table at the end of this article lists eleven sections, what each should say and whether you need it. Work down it with your draft beside you. If a row is missing from your form, either add it or be able to say why your activity does not need it. The two rows people most often leave out are withdrawal and version, because neither is visible on the day and both matter most on the day something goes wrong.

Common mistakes

One tick for everything. “I agree to all of the above” records that a box was ticked, not what was understood. Split it.

Consent wording in a field description. On a published classic form, a field’s description is only shown for file upload and photo fields. Put the words a person must read in a paragraph block above the tick, or in the tick’s own label.

A permission with no way to say no. A required checkbox whose only option is “Yes, you may photograph me” is a condition, not a consent.

A child signing for themselves. If the activity needs a guardian, the signature label should say so.

Editing the wording in place. Change it, publish, and let the new version carry the new words. Never pretend old responses agreed to text they never saw.

Build it

Build a consent form as a classic form, because an inline signature and a photo upload do not work on a published conversational form, where both fall back to a plain text box. The components that do the work are a heading and a paragraph for the explanation, checkboxes with one statement each for the decisions, radio buttons for yes or no permissions, a date picker, a single photo upload for an ID, and inline signing at the end. Add a short text for staff initials if someone explains the risks in person.

Of the four add-ons, e-signing handles a second signer, and email alerts send the answers from each submission to one address as it arrives. The signature field page shows what the inline field produces, and the tutorial on adding e-signatures with multiple signers covers the case where the person consenting is not the person filling in the form.