Q: I collect EU emails. How do I build a GDPR-compliant consent step the right way?

Q: I collect EU emails. How do I build a GDPR-compliant consent step the right way?

A: GDPR (the EU data-protection law) wants consent that's specific, freely given, and provable. Build it like this:

— Unticked box: the consent checkbox must start empty. Pre-ticked is automatically invalid.
— Plain language: say exactly who gets the data and why, in one readable sentence — no legalese wall.
— Separate purposes: marketing consent and terms acceptance are two different checkboxes, not one.
— Link the policy: a working link to your privacy policy, not a dead anchor.
— Log the proof: store timestamp, IP, the form version, and the exact text shown. That record is your defense.
— Easy opt-out: every email needs a one-click unsubscribe that actually works.

Short version: empty box, plain why, separate purposes, logged proof, real opt-out.

Still stuck? Drop your case in the comments.