The Mailchimp GDPR consent form, from checkbox to audience
A Mailchimp GDPR consent form has two jobs: collect a clear, provable yes to your newsletter, and get that yes into Mailchimp with the right status. The first is about wording and law; the second is about how your form talks to Mailchimp. This guide covers both, with copyable checkbox wording and sources from the ICO, EDPB, FTC and Mailchimp itself. It is practical guidance, not legal advice.
By Raj Kumar, Founder, Zunoform
What does a GDPR-compliant Mailchimp signup form need?
If you rely on consent for email marketing to people in the EU or UK, the signup needs an active opt-in: an unticked checkbox or a dedicated signup action, a plain statement of what they will receive and from whom, a link to your privacy notice, and an easy way to unsubscribe. You must be able to show when and how each person consented. Mailchimp’s GDPR fields and double opt-in help, but only on Mailchimp’s own forms.
- No pre-ticked boxes: silence or inactivity is not consent.
- Newsletter consent separate from terms and conditions or a purchase.
- Separate choices for separate purposes (email, post, ads).
- A record of the wording, date and source for each signup.
- Unsubscribe as easy as signing up.
What do GDPR, PECR and CAN-SPAM require for newsletter signups?
These three rules are the ones most signup forms run into. They differ on the central question: whether you need consent before the first email.
| Rule | Where it applies | Consent before emailing? | Key requirements for the form |
|---|---|---|---|
| GDPR / UK GDPR | Personal data of people in the EU or UK | When consent is your lawful basis, yes | Freely given, specific, informed, unambiguous; no pre-ticked boxes; granular options; records to demonstrate consent; withdrawal as easy as giving it |
| PECR (UK) and the ePrivacy rules it implements | Electronic marketing to individual subscribers in the UK | Yes, specific consent to email marketing, unless the soft opt-in applies | Soft opt-in only for existing customers who bought similar products and were given a clear chance to opt out; every message must offer an unsubscribe |
| CAN-SPAM (US) | Commercial email sent to US recipients | No | Accurate headers and subject lines, a valid postal address, a clear opt-out honored within 10 business days; penalties up to $53,088 per violating email |
PECR lets you email corporate subscribers (companies, LLPs, government bodies) without consent, but the ICO recommends keeping a do-not-email list for those who object. EU member states implement the ePrivacy Directive in their own laws, so check the country you market to.
Sources: ICO: What is valid consent? · ICO: Electronic mail marketing (PECR) · EDPB Guidelines 05/2020 on consent · FTC: CAN-SPAM Act compliance guide
What should a newsletter consent checkbox say?
The checkbox label has to stand on its own. Someone who reads only that line should know who will email them, roughly what about, how often if you can say, and that they can leave. Link the privacy notice right next to it rather than in the footer.
Avoid three common mistakes. A pre-ticked box, which the ICO says is not consent. A bundled line such as “I agree to the terms and to receive marketing”, which makes the newsletter a condition of something else. And a vague purpose such as “receive updates from us and our partners”, which is not specific. If you want consent for partner offers too, give it a separate unticked box.
Source: ICO: What is valid consent?
Copyable newsletter consent wording
Mixed-purpose form (enquiry, registration, checkout), unticked checkbox: [ ] Email me [Company]’s monthly newsletter with [topics]. I can unsubscribe at any time using the link in every email. See our privacy notice: [link]. Dedicated newsletter signup, text above the submit button: Sign up to get [Company]’s [weekly/monthly] email about [topics]. We use your email only to send this newsletter, and you can unsubscribe from any issue. Privacy notice: [link]. Separate purposes, one unticked box each: [ ] Send me the [Company] newsletter by email. [ ] Send me occasional offers from [Company] by email.
Replace every bracket. Keep a copy of the exact wording and the date it went live, because that is part of your consent record.
Is double opt-in required by GDPR?
GDPR does not name double opt-in. It requires you to be able to demonstrate consent, and a confirmation click is strong evidence that the address belongs to the person who signed up. That is why many EU and UK senders use it even when not strictly required. Mailchimp notes that some audiences of accounts with an EU contact address may already default to double opt-in.
The catch is where it works. Mailchimp says double opt-in for email contacts can only be enabled for Mailchimp signup forms; for form integrations or the API, it points you to your developer. In API terms, a third-party form or integration has to request the pending status itself, which triggers Mailchimp’s confirmation email. If the integration adds people as subscribed, your audience’s double opt-in setting does not apply to them.
Source: Mailchimp: About double opt-in
How do you turn on Mailchimp’s GDPR fields?
Mailchimp’s own signup forms have a built-in GDPR block. Per Mailchimp’s help center, checked 28 September 2026:
Open audience settings
Go to Audience, open the audience, and choose Audience settings from the options menu.
Enable the fields
Under Form settings, switch on GDPR fields on signup forms, then choose Configure GDPR settings.
Write the three parts
Edit the description (why you collect data), the marketing permissions (a separate checkbox for each way you plan to market, such as email) and the legal text explaining how you use contact data.
Check where they appear
The fields show on Mailchimp’s hosted, embedded and landing-page forms and the update-profile form. Mailchimp is clear that enabling them is a first step, not compliance on its own.
Segment by permission
Send only to contacts who ticked the relevant permission, using a segment on marketing permissions.
GDPR fields do not travel through integrations
Mailchimp’s GDPR fields and double opt-in live on Mailchimp’s forms. When another form tool adds contacts through the API, neither appears unless that tool explicitly sends marketing permissions or a pending status. Check what your form tool sends before assuming your Mailchimp settings apply.
What Zunoform’s Mailchimp integration sends
The native Mailchimp connection is on Pro and Business. It adds or updates one audience member per completed response. Read from the current code on 28 September 2026:
| Form information | What the connection does | What that means for consent |
|---|---|---|
| Email answer | Used as the member’s address; responses without a usable email are skipped | Ask for one subscriber email only |
| Name answer | Fills first and last name when a name is detected | Check a test contact before relying on it |
| Consent checkbox or Yes/No answer | Not read; every completed response is sent | A “No” does not stop the subscription |
| New contact | Added with status subscribed, not pending | No double opt-in email is triggered |
| Existing contact | Updated; subscription status is not explicitly changed | Do not promise re-subscription |
| Topics, frequency, marketing permissions | Not mapped to interests, tags or GDPR permissions | Handle preferences separately |
Which setup should you use?
Pick by what the form is for. The rule of thumb: connect a form straight to an audience only when every submission is a newsletter request.
Mailchimp’s own form with GDPR fields
Best when you need double opt-in and per-channel marketing permissions recorded in Mailchimp. Least flexible on design and questions.
Dedicated signup form plus native connection
A form whose only purpose is joining the newsletter, with the consent statement above the submit button. Every submission is an opt-in, so the native Zunoform connection fits. No double opt-in, so keep your own records.
Mixed form with an optional checkbox
An enquiry or registration form where the newsletter is optional. Leave the native Mailchimp connection off. Send responses through a webhook or Zapier catch hook, filter on the checkbox answer, and have that step add the contact, as pending if you want confirmation.
How do you build the checkbox in Zunoform?
Zunoform has no dedicated consent field type. Use a multi choice question with a single option, such as “Email me the monthly newsletter”, and leave it optional so it starts unticked and can be skipped. Put the privacy notice link in the question’s description. On a dedicated signup form, use a statement block above the submit button instead.
Each response is stored with its submission time, which, together with an archived copy of the form wording, forms the basis of your consent record. Do not turn on anonymous mode for signup forms if you rely on those records. Our newsletter signup template gives you email, first name, topics and frequency to start from; review its wording before connecting it, because topic and frequency answers are not synchronized to Mailchimp.
Start from a template
Consent records to keep for each signup
- Who: the email address and, if collected, name.
- When: the submission timestamp.
- What they saw: the exact checkbox or statement wording and privacy notice version.
- How: which form or page, and whether they confirmed by double opt-in.
- What they agreed to: newsletter only, or separate permissions per channel.
- Withdrawal: when they unsubscribed, so they are never re-added by a later import.
Where Zunoform fits (and where it doesn’t)
Zunoform works well for designed, embedded signup forms and for mixed forms where the newsletter is an optional extra routed through a webhook or Zapier. The native Mailchimp connection (Pro, $14.99/month) is a simple add-or-update: good for dedicated signups, wrong for mixed-purpose forms, because it does not read a consent answer, request double opt-in or send GDPR marketing permissions.
If you need Mailchimp-managed double opt-in and permission checkboxes with no extra plumbing, Mailchimp’s own hosted or embedded form is the simpler choice. Zunoform does not offer EU-only data hosting, so check your own data-processing requirements before choosing any form tool.
Questions people ask
Does Mailchimp have a GDPR consent form?
Yes. Mailchimp’s signup forms can show GDPR fields: a description, marketing permission checkboxes for channels such as email and direct mail, and editable legal text. You enable them in the audience’s settings. They appear on Mailchimp’s hosted, embedded and landing-page forms, not on third-party forms that add contacts through the API.
Do I need a consent checkbox on my newsletter signup form?
On a mixed-purpose form, such as an enquiry or checkout, yes: an unticked, separate checkbox is the clearest way to get valid consent. On a form whose only purpose is joining the newsletter, submitting it can be the opt-in, provided the form clearly says what people are signing up for and links your privacy notice.
Can the newsletter consent checkbox be pre-ticked?
No, not for consent under GDPR or UK GDPR. The ICO states that silence, pre-ticked boxes or inactivity do not constitute consent. The person has to take a positive action, such as ticking an empty box or submitting a form that exists only to subscribe them.
Is double opt-in mandatory under GDPR?
No. GDPR does not require double opt-in, but it does require you to demonstrate consent, and a confirmation click is good evidence. In Mailchimp, double opt-in can only be switched on for Mailchimp’s own signup forms; integrations and API signups must request the pending status to trigger a confirmation email.
Does CAN-SPAM require consent before sending newsletters?
No. The FTC’s guidance says you do not need consent to send commercial email under CAN-SPAM, but you must use accurate headers, include a postal address, provide a clear opt-out and honor it within 10 business days. If you also email people in the EU or UK, their stricter consent rules apply to them.
Does Zunoform’s Mailchimp integration respect a consent checkbox?
No. The native connection sends every completed response with an email to the chosen audience as subscribed, whatever a checkbox answer says. Use it only on dedicated signup forms. For optional newsletter checkboxes, route responses through a webhook or Zapier catch hook and filter on the answer.
How do I prove newsletter consent later?
Keep, for each subscriber, the timestamp, the source form, the exact consent wording they saw, whether they confirmed via double opt-in, and when they unsubscribed. Archive every version of your signup wording with the date it went live, because the record is only useful if you can show what the person agreed to.
Raj Kumar · Founder, Zunoform
Raj Kumar is the founder of Zunoform, the form builder made by Symphonic Grow. He builds the product and writes these guides, checking every competitor price and feature claim against the vendor's own pages before publishing.
Raj Kumar on LinkedInKeep reading
Ready when you are
Better forms.
Better data.
Start with a conversation, a document or a single page.
Unlimited forms and 500 responses per month on Free.
No card required.
- No credit card
- Unlimited forms
- 500 responses / month