We audit a lot of signup forms. The same failures appear almost every time, and they are all fixable in an afternoon — which makes it worth doing before someone asks.
Failure 1: the pre-ticked box
If the consent checkbox is ticked when the page loads, that is not consent. Consent has to be a positive action taken by the person. An unticked box that they tick themselves is the standard.
Failure 2: bundling
One checkbox covering account creation, marketing emails, SMS, and sharing with partners is four different purposes wearing one coat. Each purpose needs its own decision, and refusing the marketing one cannot block the account.
Failure 3: consent buried in the terms
“By continuing you agree to our Privacy Policy” does not carry consent for data processing. The notice has to be specific, readable, and presented at the point of collection — not eleven screens deep in a legal document.
Failure 4: no way to withdraw
Withdrawing consent must be as easy as giving it. If signing up took one click and withdrawing requires emailing an address that nobody monitors, that fails. This is the most commonly missed requirement we see.
Failure 5: no record
You have to be able to demonstrate that consent was obtained — what was consented to, when, and in what version of the notice. A tick in a database column with no timestamp and no notice version proves nothing.
The afternoon fix
- Untick every box by default
- Split bundled consent into one checkbox per purpose
- Write a short, plain notice shown at the point of collection
- Add a working withdrawal path — a link in the account settings and in every marketing email
- Log consent events with timestamp, purpose, and notice version
What this does not cover
Fixing the form is the visible part. Behind it sit data mapping, retention limits, breach notification readiness, and — depending on your size and sector — a Data Protection Officer. The form is where enforcement starts looking, not where compliance ends.
We run DPDPA readiness assessments free of charge. It takes about a week and tells you exactly where you stand.