Privacy-friendly sign-ups: what works under GDPR without a form.
The GDPR asks you to collect only the data a purpose needs. Many sign-up forms ask for much more: title, phone number, date of birth, all required. This guide shows what data minimisation means for sign-ups, which fields you can drop and what changes when people sign up with one sent message instead of a form.
- What data minimisation means
- Which fields you can drop
- What a sign-up without a form changes
Christian Schätzlein, Founder and developer of Sendity
3 min read
Which fields does a newsletter need?
A typical form, field by field
-
Email address To send the newsletter Field
Needed Without it, the purpose cannot be met.
-
First name For a personal greeting Field
Optional Fine as an optional field, not as a required one.
-
Title Mr, Ms, … Field
Drop it Not needed for the purpose, and a required choice excludes people.
-
Phone number “For queries” Field
Drop it Only if you really call or write. Otherwise it is data you have to protect for nothing.
-
Date of birth For a birthday voucher Field
Optional Only with its own purpose, and day and month are often enough.
-
Consent Wording, time, confirmation Record
Needed You have to be able to prove it.
Sign-ups by message. No form, no code.
Sendity is a sign-up widget for your website. Instead of filling in a form, your visitors send one short message via WhatsApp or email. Sendity checks who it came from and hands your site the name and the confirmed phone number or email address.
See how Sendity works →-
One message instead of a form Visitors tap send in WhatsApp or their email app. Nothing to type, no confirmation email to click.
-
Confirmed by the message itself The contact comes from the sender of the message, so typos and made-up addresses never reach your list.
-
Pay per confirmed contact Start with 1,000 free credits, no credit card. After that, prepaid packages with no subscription.
Five principles that shape a sign-up.
Data minimisation
Art. 5 GDPR: personal data must be limited to what the purpose needs. For a newsletter, that is the email address. Everything else may be offered as optional.
Privacy by default
Art. 25 GDPR: the default should collect as little as possible. Optional fields stay empty, and checkboxes for further uses are not ticked in advance.
Information at collection
Art. 13 GDPR: at the moment of sign-up, people learn who processes their data, for what and how long. A short note with a link to the privacy policy is common.
Storage limitation
Data may only be kept as long as needed. That also applies to technical logs of the sign-up, not only to the list itself.
Service providers
If a service verifies sign-ups on your behalf, you need a data processing agreement under Art. 28 GDPR and should name the service in your privacy policy.
A sign-up without a form.
With reverse OTP, people send one message. You receive the contact they chose, and nothing else is asked for.
One contact, chosen by the person
The visitor decides whether to sign up by email or phone. Your page needs no input fields for it.
Consent on your page
The consent wording stays on your page, before the button. The sent message confirms the sign-up.
Short-lived data
Sendity is hosted in Germany. Verification logs are optional per campaign and are deleted after a fixed period, 30 days by default.
Classic form or one sent message?
What each way collects.
| Aspect | Classic form | With Sendity |
|---|---|---|
| Fields | Often more than needed | None, the contact comes from the message |
| Other people’s data | Anyone can enter any address | Only your own contact |
| Confirmation | Separate email with a link | The sent message itself |
| Channel provider | Your mail service | The channel the visitor chooses |
This guide is general information, not legal advice. Please check your specific case with your legal or data protection advisor.
What less data gives you.
Data minimisation is a duty, and it pays off.
More sign-ups
Every field you drop is one reason less to stop.
Less risk
Data you never collected cannot leak and needs no deletion concept.
Simpler requests
Requests for access and deletion are answered faster when there is little to search.
Live on your page in minutes.
Sendity runs as a compact widget on your page. Pick the path that fits your website.
Privacy-friendly sign-ups: common questions.
May I make the name a required field?
For a newsletter, a name is usually not needed for the purpose. Offer it as optional. For a contract or an invoice, it is different.
Does WhatsApp see the sign-up?
The visitor sends a message via WhatsApp, so Meta processes it as with any other WhatsApp message. Name the channels in your privacy policy, and offer email as an alternative.
Do I need a data processing agreement with Sendity?
Yes, if Sendity processes personal data on your behalf, which is the case with the hosted service. If you host Sendity yourself, Sendity is not your processor, and the usual rules apply to your hosting provider.
Does this replace double opt-in?
The sent message is the confirmation, so you have the proof that double opt-in is meant to provide. What you document is explained in our guide on double opt-in law.
Keep reading.
Reviewed for accuracy in by Christian Schätzlein.
Sign-ups with only the data you need.
Try the live demo on your phone. It takes ten seconds.