Does a contact form need cookie consent?
A simple contact form on its own usually does not need a cookie banner, because it does not set non-essential cookies. But the personal data people type into it still falls under GDPR, and a couple of common add-ons do change the answer.
Cookies vs the data in the form
Consent banners are about cookies. A basic form that just emails you the submission sets no tracking cookies, so it does not trigger the PECR cookie-consent rule. Separately, the name, email and message are personal data, so you still need a privacy notice and a lawful basis under GDPR, just not a cookie banner for the form itself.
When a form does trigger consent
- Spam protection: some reCAPTCHA setups set cookies and send data to Google; the invisible version especially.
- Marketing tags on submit: if a pixel fires on submission to record a lead, that is a marketing cookie needing consent.
- Embedded third-party forms (Typeform, HubSpot) that set their own cookies.
The practical answer
A plain form: privacy notice yes, cookie banner no. A form with reCAPTCHA, tracking on submit, or a third-party embed: you are back to needing consent for those cookies. And if you want to count the submission as a conversion, that tracking is itself a consent-gated cookie.
Want us to check your tracking in 10 seconds?
Pop in your domain and we will show you what is firing, what is not, and where data is leaking. Free, no signup.
Check my tracking freeGet a plain-English audit
We check your live GA4, Google Tag Manager and consent setup by hand and tell you exactly what is wrong. The audit comes off any build.
See how it works & pricingDatahound are analytics and ad-tracking specialists. We fix broken GA4, Google Tag Manager and server-side tracking so every sale, form and call gets counted. Back to datahound.agency · All tracking guides · Why form submissions are not tracking