What should a newsletter sign-up form say?

A newsletter sign-up form should say who is sending, what they will send, roughly how often, and how to stop, and it should link to your privacy notice. The person should have to do something positive to agree, such as typing their address and pressing a button, or ticking an empty box. That can all fit in three lines. What follows is the wording, then what to store behind the form, because the record is half the job.

A form that does the job

Here is a mock-up for an imaginary local history society. It is an illustration only, so the button goes nowhere.

The Society's monthly letter

One email a month from the Riverside History Society with talks, walks and requests for help with our archive. Leave whenever you like using the link in any email.

Email address

Yes, send me the monthly letter

Sign up

We use your address to send this letter and nothing else. Read our privacy notice.

Now the reasoning, line by line.

Why each line is there

Who

Consent has to be specific and informed, and that is impossible if the reader cannot tell who is asking. Use your organisation's actual name. If a sister organisation will also write to them, it needs naming too. "Our partners" does not do it.

What

Describe the content honestly. If you run sponsor messages or sell a paid tier, say so here. People may accept that gladly, and it stops your first promotional issue from coming as a surprise. If you plan to use email and text, the ICO's guidance suggests letting people choose rather than taking everything as one bundle.

How often

No rule requires a frequency statement, but it is the line that most affects how the reader feels six months later. If you say monthly, then send weekly, expect unsubscribes and spam complaints, which feed into the problems we describe in the deliverability letter.

How to stop

Article 7(3) says people must be told about their right to withdraw before they consent, and that withdrawing must be as easy as agreeing. A short line about the unsubscribe link covers the first part. Your actual unsubscribe process has to cover the second.

The privacy notice

Article 13 lists what people should be told when you collect their data, including your identity and contact details, your purpose and legal basis, and their right to withdraw consent. It does not all have to sit on the form. A clear link to a page that carries it is the usual arrangement, and that page should name the email provider you use if it receives their details.

Is a tick box needed if they typed their address?

A dedicated newsletter form, where the only thing that happens is joining the newsletter, can treat entering an address and pressing a clearly labelled button as the clear act. The law asks for "a statement or a clear affirmative action", not specifically a box.

A tick box becomes necessary when the form does something else as well, such as a contact form, checkout, event booking or download. Article 7(2) requires a consent request in a wider document to be clearly distinguishable from the other matters. The ICO's consent guidance advises against pre-ticked boxes, opt-out boxes and other default settings, so the box starts empty.

Wording to retire

That last row is a judgement call rather than a bright line. Article 7(4) asks whether a service is made conditional on consent that it does not need, and that weighs against the common "email for a PDF" trade. If it matters to your business model, read the ICO's guidance on valid consent before you rely on it.

The record behind the form

You have to be able to demonstrate consent. The ICO says records should show who consented, when, how, and what they were told at the time, and whether and when they later withdrew. For online forms, it expects the submitted data plus a timestamp that ties it to the version of the form.

Many email tools store the address and the time automatically. What they rarely store is your wording. So keep a simple change log:

1. Copy the form's exact text into a dated note whenever it changes.
2. Give each form a name your tool records as the signup source, such as "website footer 2026".
3. When you import people from a paper sheet at an event, keep a photo or scan of the sheet with its wording at the top.
4. Export the records now and then, so changing provider does not lose them.

Is double opt-in compulsory?

No. We could not find any requirement for it in PECR or UK GDPR. Double opt-in means sending a confirmation email with a link, and only adding the address once the link is clicked. Its value is practical. It keeps out typing errors and addresses entered by someone else, gives you stronger evidence, and reduces the junk that drags down a list. The price is that some real people never click. For most small senders we think that is a fair trade, particularly if your form is public and could attract bots.

Keep the confirmation email plain: name, one line about what they asked for, one button. Hold the sales pitch for later, since the person has not finished agreeing yet.

If you are unsure whether your list needs consent in the first place, begin with our letter on when consent applies. Customers who bought from you may fall under the soft opt-in instead, which needs different wording.