To send promotional or general marketing communications (via newsletter, SMS, phone, etc.), the user must provide explicit consent to receive such messages.
If consent is not given, you may only use the contact information for the specific purpose of the form (like answering an information request or scheduling an appointment), but not for later promotional outreach.

For GDPR compliance, your contact form needs a clear checkbox for marketing consent, and you must store the user’s choice. Let’s see how to do this using two popular plugins—Elementor and Contact Form 7 (CF7)—but this logic applies to any contact form plugin.

How to Insert a Consent Checkbox with Elementor

If you use Elementor’s “Form” widget, follow these steps to add a marketing consent checkbox:

1. Add a new item by clicking the "Add Item" button.
2. Select "Checkbox" as the type.
3. In the "Label" field, enter: Marketing purpose.
4. In the "Options" field, enter: I give consent to receive promotional material as stated in point c of the privacy policy

How to Insert a Consent Checkbox with CF7

If you use Contact Form 7, here’s how to add a consent checkbox for marketing purposes:

1. Insert a new "checkboxes" field.
2. Set the name to "marketing purposes".
3. Add this text to the options: I consent to receive promotional materials as outlined in point c of the privacy policy

Regardless of which plugin you use, the marketing consent checkbox should never be mandatory: users must be able to contact you without having to subscribe to newsletters, SMS, or other marketing messages.

It’s also essential that the user’s consent (given or denied) is saved in a database:

• With Elementor, enable the “Record submissions” action to save entries after sending the form.
• With CF7, install the additional “Flamingo” plugin to store and manage all submitted data, including marketing consent, in the database.

Adding this checkbox, saving consent in the database, and updating your privacy policy to mention it will help ensure your marketing and newsletter activities are GDPR compliant.