To fill out a consent form correctly, name both parties in full, describe precisely what is being permitted, set a clear time frame, state any limits or compensation, and then sign and date it in front of any witness or notary the situation calls for. The document works only when each of those pieces is specific enough that a stranger reading it later can tell exactly what was agreed to. Vague language is worse than no form at all, because it creates a false sense of protection while leaving both sides exposed to disputes over what the permission actually covered.
The Five Fields Every Consent Form Needs
Whatever the purpose, the same foundational information belongs on the page. Leave any of it out and the form invites the ambiguity that makes it unenforceable.
Names and contact information. Write the legal name and current mailing address of the person granting consent (the grantor) and the person or organization receiving it. This ties the agreement to identifiable parties and gives each side a way to reach the other later.
Description of the permitted activity. Spell out exactly what the grantor is agreeing to. “Use of my image” is not enough. Say whether the image can appear in print ads, social media posts, product packaging, or all three. This is where most consent forms fail. People tend to write broad, catch-all language thinking it gives them flexibility, but courts can interpret vagueness against the party that drafted the form. Write it as though someone who was not in the room during the conversation will need to understand what was agreed to, because that is precisely the situation if the document ever reaches a judge.
Time frame. State when the permission begins and when it ends. Use calendar dates (“January 1, 2026 through December 31, 2026”) or a triggering event (“until the project is completed”). A consent form with no end date can be read as permanent, which is rarely what the grantor intends.
Scope limitations. If there are things the recipient cannot do with the permission, say so explicitly. A media release might allow use in a company newsletter but prohibit resale to third parties. Boundaries prevent the recipient from stretching the consent beyond its original purpose.
Compensation or consideration. If the grantor is receiving payment or another benefit in exchange for consent, state the amount or describe the benefit. Even a nominal exchange of value strengthens enforceability. When no payment is involved, add a short acknowledgment that the grantor is signing voluntarily and without expectation of compensation.
Format Rules That Change by Type of Consent
The five fields cover the baseline. Certain kinds of consent carry their own statutory format requirements on top, and skipping those rules can void an otherwise complete form.
Media and Photography Releases
A media release lets an organization use someone’s name, image, voice, or likeness for promotional or commercial purposes. Identify which media channels the content will appear on, whether the organization can alter the images (cropping, filters, compositing), and whether the permission extends to sublicensing, meaning the organization could pass the content to another company. When an individual’s face or distinguishing features are clearly recognizable, a signed release is the standard protection against claims involving the right of publicity.
Liability Waivers for Physical Activities
Activity waivers and assumption-of-risk forms inform participants about the dangers inherent in an activity and document that the participant chose to proceed anyway. An express assumption of risk, recorded through a signed waiver, generally prevents the injured person from recovering damages beyond the terms of the waiver, provided the waiver does not violate public policy.1Legal Information Institute. Assumption of Risk These forms work best when they name the specific risks involved. List “broken bones, sprains, and heat exhaustion” for a sports camp, rather than a blanket reference to “any and all injuries.” Most jurisdictions will not enforce a waiver that attempts to shield an organizer from liability for gross negligence or intentional misconduct, so do not treat a signed waiver as a blank check.
HIPAA Authorizations
Releasing protected health information requires a form that satisfies federal privacy rules. Under 45 CFR 164.508, a valid HIPAA authorization must include a meaningful description of the health information being released, identification of who is authorized to disclose it and who will receive it, the purpose of the disclosure, an expiration date or event, and the patient’s signature and date. The form must also inform the patient of the right to revoke the authorization in writing, state whether the healthcare provider can condition treatment on signing, and warn that disclosed information may be re-disclosed by the recipient and lose its HIPAA protection.2eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
A HIPAA authorization cannot be buried inside another document. It cannot be combined with a consent-to-treat form or a general intake packet. Authorizations for psychotherapy notes must be kept separate from authorizations for other health information. If a provider receives any payment in exchange for the records, the authorization must disclose that fact. The form must be written in plain language, and healthcare providers are required to retain a copy for six years.
Background Check Consent Under the FCRA
Employers who want to run a background check on a job applicant or current employee must follow the Fair Credit Reporting Act. Before pulling a consumer report, the employer must provide a written disclosure, on a standalone document that contains nothing else, informing the person that a background check may be obtained. The person must then authorize the check in writing.3Office of the Law Revision Counsel. 15 USC 1681b – Permissible Purposes of Consumer Reports The standalone requirement is strict: the disclosure document cannot include liability waivers, company policy summaries, or unrelated acknowledgments. Bundling these together is one of the most common reasons FCRA consent is challenged.
Releases of Personal Records
Outside the medical and employment contexts, consent forms authorizing the transfer of personal records to a third party show up in school enrollment, insurance applications, and legal proceedings. They function the same way: specify what records, to whom, for what purpose, and for how long. The laws governing the underlying records may impose their own format requirements, so check the applicable rules before drafting.
Who Is Allowed to Sign
A perfectly drafted form fails if the wrong person signs it. Capacity to sign depends on the signer, not the form.
Adults. The signer must be at least 18 years old and mentally competent, meaning able to understand what they are agreeing to. Consent obtained from someone under duress, while intoxicated, or while experiencing a mental health crisis that impairs judgment can be challenged as involuntary.
Minors. A person under 18 generally cannot sign a binding consent form on their own. A parent or legal guardian must sign on the minor’s behalf. Agreements signed solely by a minor are typically voidable at the minor’s discretion, meaning the minor can later disavow the agreement while the other party cannot. If both parents share custody, best practice is to have both sign, though one parent’s signature is usually sufficient unless a court order says otherwise. When a minor is traveling, participating in activities, or receiving medical care without a parent present, the consent form signed by the parent beforehand is the document that authorizes the activity.
Corporate signers. When a business entity is a party, the person who signs must have actual authority to bind the organization. That authority typically comes from a board resolution that names the individual, specifies the types of documents they can sign, and is certified by the corporate secretary or another officer rather than the person receiving the signing authority. The individual must sign using their name exactly as it appears in the board authorization. If the corporation maintains an official seal, it should appear on the resolution granting that authority. Contracts signed by someone who lacks documented authority can be voided.
Signing Electronically
The federal E-SIGN Act provides that a signature or contract cannot be denied legal effect solely because it is in electronic form.4Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity Forty-seven states and the District of Columbia have also adopted the Uniform Electronic Transactions Act, which reaches the same conclusion under state law. So in nearly every situation, a consent form signed through a digital platform like DocuSign or Adobe Sign carries the same weight as a pen-and-ink signature.
Consumer transactions add another layer. When a law requires that information be provided to a consumer in writing, a business can substitute an electronic record only if the consumer has affirmatively consented to receive electronic records, been told about the right to withdraw that consent, been informed of the hardware and software needed to access the records, and demonstrated that they can actually open and read the electronic format.4Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity That last piece matters. A standard email read-receipt does not satisfy the demonstration requirement; the consumer needs to confirm in a way that shows they can access the specific format being used.
Dating, Notarizing, and Keeping the Copy
Once every field is complete, both parties sign and date the form. The date is not a formality. It establishes when the permission begins and anchors any expiration period. If a new form is replacing an earlier version, note the date of the original and state that it is being superseded.
High-value agreements — those involving significant financial transfers, long-term rights, or situations where identity verification matters — often benefit from notarization. A notary public verifies the identity of each signer and applies an official seal, which makes it much harder for someone to later claim the signature was forged. Maximum notary fees are set by state law and range from as low as $2 per signature in states like Georgia and New York to $25 in Rhode Island, with several states setting no cap at all.5National Notary Association. 2026 Notary Fees by State Even when notarization is not legally required, it adds a layer of authentication that discourages future disputes.
After signing, the grantor should receive a complete copy of the executed document, and the recipient should keep the original. Both sides need access to the terms for as long as the consent is in effect, and potentially longer. Retention periods depend on the type of consent: HIPAA authorizations must be kept for six years, employment-related consent forms should be retained for the duration of the relationship plus any applicable statute of limitations, and media releases should be kept for as long as the content remains in use. When in doubt, keep the document.
Taking Consent Back
In most situations, a person who gave consent can take it back by sending a written notice of revocation to the recipient. The notice should identify the original consent form by date and subject matter, state clearly that the permission is being withdrawn, and specify the date the revocation takes effect. Sending it by certified mail with a return receipt creates proof that the recipient was notified, which matters if the revocation is later disputed.
Not all consent is revocable. When consent is given as part of a bargained-for exchange, meaning it is embedded in a contract where both sides received something of value, some courts have held that the consent cannot be unilaterally withdrawn. Consent given freely as a one-sided permission can generally be revoked at will, while consent exchanged as part of a binding agreement may be locked in for the duration of the contract. If a form includes compensation or other contractual obligations, assume that revoking it may trigger breach-of-contract consequences rather than a clean walk-away.
For electronic consent, some state regulations require that the process for withdrawing consent be as simple and take roughly the same number of steps as the process for granting it.6Legal Information Institute. Colorado Code 4 CCR 904-3-7.07 – Refusing or Withdrawing Consent If a single button granted consent, an opt-out buried behind a phone call and a mailed form would not satisfy that standard.