Consent done must be registered including date and time

[simone80an]

For GDPR requirements it isn't enough that an user click accept on registration but the consent must be registered somewhere (eg. in the database) including date and time.
Users should also be able to revoke consent at any time.

I have added a custom field with a checkbox checked to show in the registration form.

[AndreRl]

For reference - https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/consent/ 11th bullet point down.

Keep evidence of consent – who, when, how, and what you told people.

@simone80an Note that the custom field with a checkbox shouldn't be checked by default. See 4th bullet point down.

Consent requires a positive opt-in. Don’t use pre-ticked boxes or any other method of default consent.

I'd argue that just clicking "I Accept" may not be enough and that a checkbox may actually be required.

[simone80an]

Thanks, how can i make the checkbox unchecked by default?
I haven't found in custom profile fields admin settings.

The generated html code is:

<input type="checkbox" class="checkbox" name="profile_fields[fid4][]" value="" checked="checked">

[Ben-MyBB]

As far as my understanding goes the above is certainly correct. A simple check box is no longer sufficient to register consent I believe.

[Ben-MyBB]

Proof of consent (Article 7(1))
Recording the wording and the act of ticking a box should be recorded because of the requirement for marketers to be able to prove consent:
Where processing is based on consent, the controller shall be able to demonstrate that consent was given by the individual to the processing of their personal data
Wording or processes which are ambiguous or confusing will not satisfy GDPR consent requirements.
Data without recent consent to these standards may need to be re-permissioned or deleted.

We should probably record the time, date and IP address that was used to opt in.

[Eldenroot]

One of my users just mentioned this... this should be included to comply with GDPR reg.