Webinar Registration Form Consent Checklist for the EU and UK

What Is Webinar Registrant Consent, and What Does the Form Have to Do?

Webinar registrant consent is the separate, channel-named permission a person gives on the registration form, and it is what satisfies the prior-consent requirement in Article 13(1) of the ePrivacy Directive for that channel. It is one of four gates a call has to pass, and the only one a registration form can win. It is not the registration itself, and it is not the fact that they typed a phone number into a field. The registration is the event sign-up. The consent is a distinct thing that either sits next to it on the form or does not exist.

That distinction is the whole page. It is also why the useful question is never "can we call webinar registrants?" but "what did the form ask them, and can we produce it?"

Where Does This Checklist Stop and the Legal Analysis Start?

Four independent rule sets sit between a registration and a call that connects: the ePrivacy Article 13 channel consent, the GDPR rules on lawful basis and purpose, national numbering and caller-identification law, and the EU AI Act Article 50 disclosure duty from 2 August 2026. A registration form can win the first and, if it names the purpose, the second. It has no effect on the third or the fourth. This page covers only what the form itself has to say; the four gates, the statutory wording behind each of them and the country-by-country picture for Lithuania, Germany, France, Spain, Poland, Italy and the UK are set out in full on is it legal to call webinar registrants in the EU and UK.

Which Gate Can a Registration Form Never Open?

The numbering one, and it is worth knowing before you spend a week on form wording. In France, ARCEP décision n° 2022-1583 of 1 September 2022 provides that certain territorialised numbers - geographic numbers, polyvalent numbers and ten-digit mobile numbers - may not be used as the caller identifier presented to the called party for calls issued by automated calling and message-sending systems (source). The decision grants a derogation to numéros polyvalents vérifiés - roots 0162, 0163, 0270, 0271, 0377, 0378, 0424, 0425, 0568, 0569, 0948, 0949 (09475-09479 in the DOM) - which is why running France means procuring a number from a French NPV operator. The trigger is automated mode, not consent.

In Germany, § 120 TKG obliges providers to transmit a complete, genuine German number and to suppress the display where a foreign-originated call presents one (source). In Spain, the Resolución of 14 April 2026 reserves the nine-digit NXY=400 range exclusively as the origin of outbound commercial calls and gives operators six months to make it operational, so around mid-October 2026; the duty to use it sits upstream in Ley 10/2025 and Orden TDF/149/2025, which we have not read in full - we assume it applies, because assuming otherwise is the expensive mistake (source). In Italy, AGCOM delibera 106/25/CONS requires operators to block calls arriving from abroad with a spoofed Italian caller identity, for fixed lines from 19 August 2025 and for mobile from 19 November 2025 (source).

Which Purposes Does Your Registration Form Have to Name?

All of the ones you intend to run, and the sales follow-up is the one most often missing. Confirming attendance, or reminding someone about a session they asked to join, serves the purpose they registered for. Working the attendee and no-show list afterwards to book a sales call is a different purpose, and the form is the only place it can be authorised in advance.

Consent has to be specific. Article 4(11) defines it as a specific indication of the person's wishes, and Article 5(1)(b) requires purposes to be specified and explicit at the point of collection (source). A consent given to receive webinar information is therefore not a consent to a sales follow-up call. Article 6(4)'s compatibility test is written about whether the further processing has its own consent or Member State law footing - and Recital 50 goes further, allowing further processing "irrespective of the compatibility of the purposes" where the data subject has consented (source). Which is exactly why the consent has to name the purpose in the first place: the escape route runs through the consent, and a consent that never mentioned the follow-up cannot carry it. If the form did not name it, you ask again.

Read together with the demonstrability duty in Article 7(1), there is only one design that holds up: the registration form names the follow-up purpose and the channels up front. That is not fine print we are hiding at the bottom of a contract. It is the first deliverable, and it is the reason we look at the form before we look at the list.

It is also, in several markets, the only route that exists. Where national law requires prior express consent for automated calls - Germany being the clearest case - a well-built registration form is not a nice-to-have. It is the single place that consent can realistically be captured, which is why we treat the form audit as the first piece of work rather than a disclaimer bolted onto the last one. If your post-webinar follow-up plan needs a consent your current form does not collect, we would rather tell you in week one.

Does the Form Have to Change per Market?

The checklist below is written to satisfy the strictest of the markets we cover, so the wording itself travels. What does not travel is the surrounding law: in Germany the consent is the only route there is (§ 7(2) UWG); in Poland the same is true and there is no soft opt-in at all (article 398 of the Prawo komunikacji elektronicznej); in Spain the consent rule sits in Ley 11/2022, article 66.1.a); in Italy an entry in the opposition register revokes telephone consents expressed earlier, so the consent date on your form is load-bearing; and in the UK the equivalent is regulation 19 of PECR. We apply the rules of the country we are calling into, and the market-by-market reading - including what we could and could not verify - is set out on is it legal to call webinar registrants in the EU and UK.

What About Recording the Calls?

Here we publish product behaviour rather than legal conclusions, and we want to be explicit about why. When we searched our own compliance research for substantive national treatment of call-recording consent, we found effectively none outside Germany. Rather than invent a position, we describe what the system does and leave the legal question where it belongs.

Recording is off by default. Where a client enables it, the agent announces it at the start of the call and consent is captured before recording begins; recordings are retained for a defined period and deleted afterwards. Retention periods are set per client and per market - outside Germany we will not publish a number we cannot ground.

Where Does Our Knowledge Stop?

A compliance page that only lists what it knows is a sales page, so here is the short version for this one. Our research was built on cold outreach and never analyses the consented-registrant case; whether a confirmation or reminder call counts as "direct marketing" is unresolved and we do not build the offer on a service-message theory; and one national gap is still open - we could not retrieve the consolidated Lithuanian transposition text, so the Lithuanian national detail stays marked unconfirmed rather than papered over. The full list of open questions, with the position we take on each and why, is on is it legal to call webinar registrants in the EU and UK.

What Does Your Registration Form Actually Have to Say?

This is the artifact the rest of the page exists to produce. Take it to whoever owns your registration form. Every item maps to a provision quoted above, and the whole list is short enough to fix in an afternoon - which is the point, because fixing it afterwards is not an option that exists.

What Do We Commit To on Every Campaign?

These are statements about what the system does, with the provision each one answers to. They are not statements about what the law permits in your particular case - that remains yours and your counsel's to settle.

• We contact only people who registered themselves and who, on the registration form, clearly agreed to be contacted by phone, SMS or email - and we hold the record of that agreement.
• Every call, SMS and email identifies on whose behalf the contact is made and carries a working way to opt out.
• From 2 August 2026, in line with Article 50 of Regulation (EU) 2024/1689, we state at the start of the conversation that the caller is an AI assistant - and we do it before that date too.
• When someone asks not to be contacted again, the number goes onto a suppression list across every channel immediately and is not used for marketing again (GDPR Article 21(3)).
• We call from a genuine, non-suppressed, non-manipulated number, and where a market requires specific numbering we solve that with a local operator rather than working around it.
• We consult the advertising exclusion systems in the markets that operate them, including the Lista Robinson in Spain and the opposition register in Italy, and we honour exclusions.
• On personal data we act as your processor under a GDPR Article 28 data processing agreement, only on your documented instructions, with sub-processors disclosed. You remain the controller and you own the form wording and the privacy notice.
• Recording is off by default; where it is enabled the agent announces it and consent is captured before recording begins. In Germany, calls are recorded only with the participants' agreement.