Email popups and GDPR: how to collect consent [2026]

A signup popup collects personal data, so the GDPR applies to it from the moment a visitor types an email address in. What the regulation asks for has not changed since 2018: a clear purpose, a real act of agreement, and a record you can produce later.

The difficulty sits in the popup rather than the regulation. Whether the checkbox is needed at all, what the consent line has to name, and what you can produce if someone asks two years later.

This article covers the wording and the settings that satisfy those three:

• The GDPR popup checklist

• What the GDPR requires

• Checkbox or double opt-in

• Incentive copy rules

• Special category data

• Four campaigns reviewed

• Adding a checkbox in Wisepops

• Your privacy policy

• Consent records and old lists

The GDPR popup checklist

Six of the thirteen are visible to the visitor, and they fit on one popup:

Thirteen checks in all, grouped by where you go to verify each one:

What the GDPR requires from a signup popup

A popup that collects an email address needs a lawful basis for the marketing that follows, and for a newsletter that basis is consent.

Article 4(11) of the GDPR defines consent as a freely given, specific, informed and unambiguous indication of the visitor's wishes, given by a statement or by a clear affirmative action.

That definition, plus the conditions in Article 7, comes to seven rules:

• Say what they are getting. The popup names who is collecting the address, what will be sent, and where the privacy policy is.

• One consent per purpose. Email marketing and SMS marketing are two purposes, so they need two agreements.

• Ask for an action. Checking an empty box, or submitting a form that exists only to subscribe. Silence and pre-checked boxes count for nothing.

• Consent cannot be a condition. Agreement stops being free when someone has to accept marketing to get something the marketing has nothing to do with. A prize entry gated behind a newsletter opt-in is the case this was written for.

• Keep it separate. Where the consent sits inside wording that also covers other things, the consent part has to stand out, in plain language. One box covering terms of sale and marketing fails.

• Make leaving as easy as joining. People can withdraw whenever they want, they have to be told so before they agree, and getting out cannot be harder than getting in. One click to subscribe and an email to support to leave does not qualify.

• Keep proof. You have to be able to show that the person agreed. A signup with no record behind it is a signup you cannot defend.

The shortcuts are ruled out too. Silence, a pre-ticked box and plain inactivity are not consent.

The Court of Justice settled the pre-ticked box question in a 2019 ruling against Planet49, a German lottery operator that pre-ticked the box for entrants. Only an active step counts.

European regulators have gone further and held that scrolling or swiping down a page can never count, because nobody can tell that behavior apart from ordinary reading.

Who these rules apply to

Article 3 ties the GDPR to where the visitor is and what you are doing, and not to where your email platform is hosted. Storing your list in a US tool does not put the collection outside the regulation.

Three cases make the boundary clear:

• A store in Texas selling hats and belts worldwide has to comply for its European customers, including anyone who subscribes through a popup from an EU country.

• A SaaS company in Germany selling in Europe and the US complies for its European subscribers, because the company is established in the EU.

• A Shopify store in Hong Kong selling only in Asia, with no offer aimed at people in the EU, falls outside the regulation.

Under-16s need a parent's consent

The age of digital consent is 16. Below it, a parent has to give or authorize the consent, and you have to make reasonable efforts to check that they did.

Countries can lower it to 13 but no further, so the number changes as you cross a border. Germany and the Netherlands kept 16, Austria and Italy chose 14, and Ireland, Spain, Sweden and the UK went to 13.

Two things narrow this in practice. The rule covers services offered directly to children, so a site that says it serves adults only, and whose content and marketing back that up, falls outside it.

The other is your lawful basis. The age rule bites when you are relying on consent, which is exactly what a newsletter popup does, so a brand with teenage customers is squarely inside it.

Where your audience skews young, an age field on the form is the usual answer. Asking whether the visitor is above or below the relevant age lets you route the under-age case to a parental authorization step instead of straight onto the list.

The consent checkbox, and what double opt-in adds

An unchecked consent checkbox is the most defensible way to get an affirmative action out of any popup type, because the visitor does something separate from clicking submit. That separation is what a supervisory authority looks for when purposes are combined.

There is an exception most guidance misses. Where the form exists only to subscribe someone to a newsletter and the popup says so, submitting the form is itself the affirmative action.

A second checkbox adds nothing in that case, and our own documentation takes the same position.

When a separate checkbox is needed:

• The form collects the address for one reason and you also want to send marketing, such as a contest entry, a stock alert, or a downloadable guide.

• The form collects both an email address and a phone number, since SMS consent has to be given on its own.

• The address will be shared with a partner brand or used for advertising audiences.

• Your legal counsel wants a visible, auditable act on every signup, which is a common internal standard even where the law allows less.

GDPR marketing consent examples

Short, specific, and written as something the visitor agrees to.

Three versions that meet the conditions:

Wording that only says "I accept the privacy policy" is weaker, because accepting a policy is not the same act as agreeing to be emailed. The emails have to be named in the sentence itself.

Where you want one line that names the channel, settles the conditionality point and covers withdrawal at once, this is the pattern:

Double opt-in is not a GDPR requirement, and turning it on does not repair a consent request that was unclear in the first place. What it gives you is evidence: a dated click on a link the visitor received at an address only they control.

That evidence sits in your email platform, which is where you will look when someone asks you to prove consent.

The confirmation email needs three things to carry its weight:

• The purpose of the collection, in the same words the popup used.

• A link to your privacy policy.

• A line telling the subscriber they can unsubscribe and request access to their data at any time.

Double opt-in is configured in your email platform rather than in the popup tool, and the same confirmation step clears typos and throwaway addresses out of the list you are building. Plenty of brands run it with no regulatory motive at all.

What a lead magnet, discount or prize has to say

The campaigns above were finished work. This is the wording problem that produces them, and it only appears once you offer something in exchange for the address.

Article 5(1)(b) limits you to the purposes the visitor agreed to. An address collected to deliver one ebook can be used to deliver that ebook, and nothing else, which is where most lead magnet campaigns come apart.

The fix is in the copy, and it costs nothing.

Compare the two versions:

• "Enter your email to receive our free ebook." One purpose, one send, no newsletter.

• "Enter your email to subscribe to our newsletter. As a welcome gift, you'll receive our exclusive ebook." Two things covered, and the gift no longer looks conditional on subscribing.

The second version also handles the freely given condition. Consent stops being free when a visitor has to accept marketing to get something the marketing has no bearing on, so frame the ebook as a welcome gift for subscribers instead of a reward for consent.

Discount, lead magnet and gamified popups

Every incentive campaign splits the same way, whether it is a discount popup or a gamified wheel. One purpose is the thing the visitor asked for, and anything beyond it needs its own agreement.

How that plays out by campaign type:

A gated entry is the pattern the freely-given rule was written for, so the campaign mechanic and the consent have to stay apart. The émoi émoi giveaway reviewed above is that structure done properly.

When quiz answers become special category data

Quiz answers become personal data the moment they are attached to an email address. A short list of them cannot be collected on ordinary consent at all.

Article 9 puts these categories off limits without explicit consent:

• Health, including a condition, a symptom, a medication or a pregnancy.

• Religious or philosophical belief, racial or ethnic origin, political opinion, trade union membership.

• Genetic and biometric data.

The second group catches more than it looks. The wording covers data revealing a belief, so an answer never has to state one to be inside the category.

Four rules keep a quiz popup clear of it:

1. Ask about the product, not the person. This solves it in most cases and costs nothing.

2. Where the category is genuinely needed, take a separate explicit consent that names what you collect and why. Newsletter consent never covers it.

3. Store only the answers you will act on, and drop the rest at submit.

4. At volume, run a data protection impact assessment, since these categories in quantity are one of the triggers.

Rule one in practice, on a skincare quiz that would otherwise collect a diagnosis:

Four signup campaigns reviewed against the rules

Reading the conditions is one thing and recognizing them in a live campaign is another. There are ecommerce popup examples and popup design examples to compare against.

All four below are campaigns we built, audited against every rule above, and each one solves a different part of the problem.

A newsletter popup with no checkbox at all

Emma Sleep runs a discount offer as a newsletter signup, and the whole consent argument sits in the copy rather than in a control the visitor has to tick.

Emma Sleep's Easter campaign, with the offer terms and the consent line under the button:

What this campaign gets right:

• The headline names the newsletter before it names the discount, so the purpose is stated ahead of the incentive.

• The consent sentence names who will send the emails, rather than leaving the sender implied.

• The offer footnote carries the promotion window down to the second, so "up to 25% off" is a claim the visitor can check. Dated offers are standard in Black Friday campaigns.

• The form does one thing, so the submit is the affirmative act and a separate checkbox would add nothing.

The one line to add:

• "Unsubscribe at any time", in the same sentence. The consent line links the privacy policy but never says the visitor can withdraw, and that has to appear before they agree.

Email and phone captured on separate steps

Maison Lejaby splits the request across two steps, taking the email address first and the phone number second, which is the cleanest structural answer to the one-consent-per-purpose rule.

The second step, where the phone number and its own consent text sit:

What this campaign gets right:

• The email address and the phone number are collected on separate steps, so each channel gets its own act of agreement.

• The consent text names the channel specifically, WhatsApp, where a vague "communications" would fail the specificity condition.

• "Not now" gives the visitor a visible decline of equal weight to the accept, the same principle regulators apply to consent interfaces generally.

• The step states that the visitor can unsubscribe at any time, covering the notice the Emma Sleep campaign leaves out.

Messaging consent is never carried by an email opt-in, and splitting the steps makes that visible in the campaign rather than buried in a policy.

A US disclosure, and what an EU version would change

This grant campaign runs on a US university site, so the disclosure is written to the TCPA and the GDPR does not reach it. That makes it the useful contrast, because it shows how far the two regimes diverge on the same form.

The disclosure under the signup button, written to US rules:

What this campaign gets right:

• The disclosure states that consent is not a condition of any service, which is the freely-given point said out loud.

• The visitor is told they may opt out at any time.

• Three fields and nothing else, which is data minimization in practice.

What an EU or UK version would change:

• Agreement to automated calls and text messages "for any reason" is the opposite of specific, and a purpose that broad cannot be consented to at all.

• Calls and texts are bundled into the same act as submitting a grant enquiry, and those have to be kept apart.

• No unchecked box separates the marketing channels from the enquiry itself, so an EU version needs one.

• Nothing establishes the visitor's age, and an audience for a tuition grant includes under-16s, which is where the age rules bite.

A giveaway with the marketing consent kept separate

émoi émoi runs a giveaway with several gifts and incentives, and puts the newsletter opt-in on its own control rather than folding it into the entry.

The giveaway campaign, with the consent checkbox under the email field:

The consent text reads: I agree to receive newsletters from émoi émoi by email. Our privacy policy is available here.

What this campaign gets right:

• The box arrives unchecked, so ticking it is the affirmative act the rules ask for, and the pre-ticked pattern the Court ruled out is avoided.

• The consent text names the channel and the sender in one sentence, which is the specificity condition met without legal wording.

• The newsletter opt-in is a separate control from the giveaway entry, so agreeing to marketing is not the price of taking part. So the newsletter is not the admission price, which is the test that matters here.

• The privacy policy is reachable from inside the popup, which is where the notice has to arrive.

The one line to add:

• "You can unsubscribe at any time", added to the consent text. Same gap as Emma Sleep. Linking the words "our privacy policy" instead of "here" would also read more clearly.

Serving the stricter version only where it is required

Running a US site and an EU site off one popup campaign is how this gap usually appears. A single design can carry two consent treatments, selected by where the visitor is.

How to split a campaign by region:

1. Duplicate the campaign, so you have an EU and UK variant and a rest-of-world variant.

2. Add the unchecked consent checkbox and the withdrawal line to the first variant.

3. Set location targeting on each variant, with the EU and UK countries on one and the remaining markets on the other.

4. Check that the two variants cannot both qualify for one visitor, or a visitor sees two popups.

Our targeting options reach the country level and finer, so the split does not need separate campaigns per market.

How to add a terms and conditions checkbox in Wisepops

We put the consent checkbox on the form field itself, which keeps the text, the link and the field validation in one place. Ticking the box becomes a condition of submitting.

How to add the checkbox and the link:

1. Open the campaign in the editor and click the signup form.

2. Select the email field, then open the Terms section in the left panel.

3. Turn the terms checkbox on and write your consent text in it.

4. Select the words that should carry the link, and point them at your privacy policy or terms page.

5. Leave the box unchecked by default, then save and publish.

Here is the Terms section on an email field, with a consent line and a linked privacy policy:

Add a phone field to the same form and it carries its own terms text, which is how you keep email consent and SMS consent apart.

The same field settings drive a welcome popup and embedded signup forms, so a popup and an inline form on the same site can share one consent line.

What your privacy policy needs to say about your popup tool

Article 13 is the provision that decides where the privacy policy link goes, because the information has to reach the visitor at the moment you take the address. A footer link arrives later than that.

What the visitor has to be able to find:

• Who you are, and how to reach you.

• What you are going to do with the address, and on what basis.

• Who else sees it, which is where your processors sit.

• Whether it leaves the EU, and what protects it if it does.

• How long you keep it.

• What they can do about it: see it, correct it, delete it, take it elsewhere, object, withdraw, or complain to a regulator.

Two qualifiers sit around that. Information the visitor already has can be left out, and a new purpose means telling them before you use the address for it, which is the rule a lead magnet list reused for a newsletter runs into.

We act as a data processor and handle your subscribers' data on your instructions, which makes you the controller. Naming your processors, or at least the categories of recipients, is the part of a privacy policy that popup tools affect.

Our data processing agreement gives you the details your policy and your records need:

• The data processed: names, email addresses and phone numbers collected through your campaigns, plus browsing signals such as the last visit, campaign interactions and the visitor's IP address.

• The sub-processors: Google Ireland Limited and Amazon Web Services EMEA for hosting, and Cloudflare for content delivery.

• Retention: data is kept for the duration of your subscription unless you say otherwise.

• Breach notification: we notify you within 72 hours of becoming aware of a personal data breach.

A signed copy of the agreement is downloadable from that page, and the technical and organizational measures are published alongside it. Both are what a security review or a DPIA will ask you for.

A section you can adapt for your policy:

The provider list covers every tool that touches a subscriber record, including the popup tool, the email platform and any SMS provider. A policy naming two of the three is the version that fails a review.

Consent records, and lists you cannot prove consent for

The burden of proof sits with you. Storing an address and a signup date is thinner than it looks, because the question a regulator asks is what the person actually saw when they agreed.

Four fields answer that question, and a record holding only the first is a record you cannot defend:

Where the record actually lives

The popup collects the consent and your email platform stores it, so the fields have to survive the handoff. Both of the platforms most ecommerce brands run have a place for them, and neither fills it in by default.

Two configurations to check before you trust your records:

• Klaviyo. Consent-enabled forms write $consent_method, $consent_form_id, $consent_version and $consent_timestamp onto the profile. The version property is the one that answers which variation of your wording a subscriber saw.

• Mailchimp. Marketing permissions have to be enabled on the audience, and a custom integration sending contacts through the API has to pass the marketing permissions explicitly. Adding an address to a list on its own records no consent.

Where Shopify checkout is also collecting an accepts-marketing flag, confirm it lands on the same profile property as your popup signups. Two sources writing to two different fields is how a subscriber ends up with a consent status nobody can trace.

Subscriber rights and the response window

Subscribers can also come back with a request.

Five of them apply to a marketing list:

• See the data you hold on them.

• Have it corrected.

• Have it deleted.

• Take it elsewhere in a portable format.

• Object to the processing altogether.

You get one month to respond, extendable by two more where the request is complex, provided you tell the person about the extension inside that first month.

Withdrawal carries one rule that is easy to miss. When someone withdraws consent, you stop, and you cannot keep sending the same emails by relabeling the basis as legitimate interest.

Swapping the lawful basis after the fact is not available. You pick the basis before you start and you disclose it up front, and switching it when consent runs out would make the right to withdraw meaningless.

The response also has to be free. Charging for a copy of someone's data, or for acting on a deletion request, is available only where a request is clearly unfounded or excessive, and you carry the burden of showing it was.

A deletion request reaches your processors too, so it has to travel to your popup tool and your email platform.

Lists collected before you had valid consent

The GDPR applies to addresses collected before May 2018 as much as to ones collected yesterday. Where you cannot show a valid consent for a segment, a re-permission campaign is the way to sort it.

The email asks the subscriber to confirm, in one click, that they still want to hear from you.

The click is the affirmative act, so three things have to hold:

• No pre-selected outcome anywhere in the message.

• No wording that treats silence as a yes.

• The same purpose named in the original signup, so the confirmation covers what you will actually send.

Everyone who does not confirm comes off the list. A smaller list of people who chose you outperforms a large one that no longer opens anything, and lifecycle campaigns work better against it.