Which form does a consent need?
Whether a consent is valid rarely depends on a signature. For most declarations around an offer, the law prescribes no form, not even for photos. What matters is that you can later prove who declared what and when.
Note
The explanations here classify terms and do not replace legal advice. For your individual case, for example with health data or as a youth welfare office, contact the data protection officers of your organisation.
What do written form, text form and no form mean?
A form applies only when a law requires it or the parties agree on it. Without such a rule, a declaration needs no form. It is then valid when given orally, with a click or by ticking a box.
| Form | What it requires | Examples |
|---|---|---|
| Written form (§ 126 BGB) | A handwritten signature on paper. Electronically only with a qualified electronic signature, and not everywhere | Fixed term of an employment contract (§ 14(4) TzBfG), termination of an employment contract (paper only, § 623 BGB), guarantee |
| Electronic form (§ 126a BGB) | An electronic document with the person's name and their qualified electronic signature | Replaces the written form where the law allows it |
| Text form (§ 126b BGB) | A legible declaration on a durable medium that names the person declaring. No signature | Email or PDF, for example a demand for a rent increase; since 2025 also leases of commercial premises |
| No form | No form | Registration for an offer, photo consent, permission to go home alone |
A durable medium is something the person can store and that does not change afterwards. An email or a PDF meets this. A page on a website that its operator can change at any time does not.
Administrative procedures follow a rule of their own. Where a law requires the written form there, an online form of the authority used with the German online ID card, or a qualified electronic signature, also meets it (§ 3a VwVfG). No law requires the written form for the consents of a holiday programme.
How do simple, advanced and qualified signatures differ?
The EU regulation on electronic identification and trust services, eIDAS for short (Regulation (EU) No 910/2014), knows three levels. Each higher level meets the requirements of the lower ones.
| Level | Characteristics | Examples | Effect |
|---|---|---|---|
| Simple electronic signature (Art. 3(10)) | Data attached to a declaration with which someone signs | A typed name, a scanned signature, consent by a click in one's own account, a name below an email | Valid for any declaration that needs no form. Its value as evidence depends on what else is recorded. |
| Advanced electronic signature (Art. 26) | Uniquely linked to a person who can be identified. Created under their sole control. Later changes are detectable. | A signature with a personal certificate that a signing service issues after checking the person's identity | Like the simple signature, with a higher value as evidence |
| Qualified electronic signature (Art. 3(12)) | An advanced signature with the qualified certificate of an approved trust service provider | A signature by app after identification with the online ID card or video identification | Equivalent to a handwritten signature (Art. 25(2)). Meets the written form where the law allows the electronic form. |
In court, a simple or advanced signature is freely assessed as evidence (§ 286 ZPO). A qualified signature has the same evidential value as a signed document (§ 371a ZPO).
Where the law requires the written form, a simple signature is not enough. The Berlin Labour Court therefore held invalid the fixed term of an employment contract that was signed electronically but not with a qualified signature (ArbG Berlin, 28.09.2021, 36 Ca 15296/20).
A qualified signature costs money and requires the person to identify themselves first. The EU Digital Identity Wallet (EUDI Wallet) is to let private individuals sign with a qualified signature free of charge. Germany has announced its wallet for 2027.
When does the GDPR apply and when not?
Many declarations at registration are called consent but follow different rules. The General Data Protection Regulation (GDPR) applies only to consent to the processing of personal data. Civil law governs other declarations.
Consent under the GDPR
Consent under the GDPR permits processing of data that would not be permitted without it (Art. 6(1)(a) GDPR). One example is publishing photos on the website. For data you need for the registration, such as name and emergency number, the registration itself is the legal basis (Art. 6(1)(b) GDPR). You do not need consent for it.
The GDPR prescribes no form. Consent must be freely given, informed and unambiguous. A pre-ticked box is not enough (CJEU, 01.10.2019, C-673/17, Planet49).
In return, the GDPR requires two things. Whoever processes the data must be able to prove the consent (Art. 7(1) GDPR). The person can withdraw it at any time, and withdrawing must not be harder than consenting (Art. 7(3) GDPR).
For health data, such as allergies or medication, consent must be explicit (Art. 9(2)(a) GDPR). A clear yes to a clearly worded text is enough; the GDPR does not require a signature. If a youth welfare office runs the offer, the data can be social data. For health data, § 67b SGB X then requires consent in writing or in electronic form.
For photos, the German Art Copyright Act applies alongside the GDPR. Whoever publishes a portrait needs the consent of the person shown (§ 22 KUG). This consent needs no form either.
Declarations outside the GDPR
Permission to go home alone and agreement to a canoe trip concern the duty of supervision. Terms of participation and a liability waiver are part of the contract for taking part. The law prescribes no form for any of these declarations.
A liability waiver has limits that no form shifts. In standard terms, liability for injury to life, body or health caused by negligent breach of duty cannot be excluded (§ 309 No. 7 BGB). A handwritten signature does not change this either.
Who decides for a child?
For minors, the parents declare. If two parents share parental responsibility, they represent the child jointly (§ 1629 BGB). One parent can act alone in agreement with the other.
For photos and data, it also matters whether the child can judge the consequences. From about 14, the child's own agreement is therefore usually obtained as well. The law sets no fixed age for this.
Which declaration needs which form?
| Declaration | Legal basis | Form required by law | Decision in fepli |
|---|---|---|---|
| Publishing photos and videos | GDPR, KUG | None; the consent must be provable | Choose yes/no |
| Health information, such as allergies | GDPR, Art. 9 | None, but explicit. For social data in writing or electronic form (§ 67b SGB X) | Choose yes/no |
| Going home alone | Duty of supervision | None | Choose yes/no |
| Taking part in a canoe trip, staying overnight at a tent camp | Contract, duty of supervision | None | Required |
| Terms of participation, liability waiver | Contract | None; limits under § 309 No. 7 BGB | Required |
| Newsletter, information about future offers | GDPR | None | optional, opt-in |
| Fixed term of a supervisor's employment contract | TzBfG | Written form or electronic form | Not in fepli |
| Termination of a supervisor's employment contract | § 623 BGB | Written form on paper only | Not in fepli |
Which decision fits which declaration is explained in Mandatory, opt-in or yes/no?.
What does fepli record?
A decision on the website is a simple electronic signature. This is enough for any declaration that needs no form. It serves as evidence through what fepli stores with every decision:
- the wording of the declaration and of the additional information as they read at the time of the decision, with a checksum
- the time of the decision and the way it reached fepli
- the name of the person who decided, as it read at that time
- the language and the text shown, if the website showed the declaration in a machine translation
- for a decision for a child, the assurance of holding parental responsibility and, from 14, that the child agrees
- for a decision without an account, the email address from which it was confirmed
- for a consent the team recorded on someone's behalf, the uploaded paper evidence
Without an account, a decision counts only once the person has confirmed their email address. This applies to a registration without an account and to legal guardians who decide through the link to a registration. Until then, fepli records no consent.
For every consent given, fepli stores a PDF. If it is in the instance's object storage, it is locked against deletion for as long as the evidence has to be kept. The family receives a copy by email, with the wording and a link through which they withdraw the consent without signing in. This way the declaration is also on a durable medium on their side.
What can fepli not do yet?
fepli does not yet offer:
- Advanced and qualified electronic signatures. Declarations for which the law requires the written form, such as employment contracts, therefore do not belong in fepli.
- An identity check with the online ID card or an EUDI Wallet. A confirmed email address only shows who has access to the mailbox.
- Separate decisions by both parents. One parent assures that they act in agreement with the other.
- The consent of a child from 14, obtained from the child themselves. The parent assures it.
- Qualified time stamps and electronic seals for the evidence. The checksum shows whether a stored wording was changed. It does not prove when it was stored.