How to Make a Legally Binding Consent Form: Content, Signing, and Storage

A consent form is legally binding when a competent adult signs it voluntarily after receiving enough clear information to understand what they are agreeing to. Knowing how to make a legally binding consent form comes down to getting three things right in substance — capacity, informed disclosure, and voluntariness — and then layering on the specific disclosures required by whatever law governs the activity. A beautifully formatted form that buries risks in fine print or pressures someone into signing can still be thrown out.

The Three Legal Pillars

Every enforceable consent form rests on the same foundation. If any one of these is missing, the signature may not hold.

Capacity. The person signing must be able to understand what they are agreeing to and weigh the consequences. That generally means being of legal age and having sufficient cognitive function to process the information. The National Institutes of Health defines consent capacity in research as “an adult’s ability to understand information relevant to making an informed, voluntary decision to participate.”¹ A signature from someone who lacks capacity because of age, cognitive impairment, or intoxication does not create valid consent on its own.

Informed disclosure. The signer has to receive the relevant information before signing, and that information must be “conveyed in language understandable to those being asked to participate.”² Handing someone a dense document and rushing them through it does not meet the standard. They need a real chance to read, ask questions, and understand.

Voluntariness. Consent must be freely given. Federal regulations require “a statement that participation is voluntary, refusal to participate will involve no penalty or loss of benefits to which the subject is otherwise entitled, and the subject may discontinue participation at any time without penalty.”³ The same principle applies outside research. If a patient was told they would be denied care, or an employee was told they would be fired, the consent can be challenged as coerced.

Standard contract principles sit underneath all of this. Both sides need to understand what is being agreed to, the purpose must be lawful, and the signer must intend their signature to carry legal weight. A consent form for an illegal activity is unenforceable no matter how carefully it is drafted.

What Every Consent Form Should Contain

The specific disclosures vary by context, but a form that is missing any of the following has gaps that can undermine its enforceability.

A Clear Description of What Is Being Consented To

State plainly what the signer is agreeing to. For a medical procedure, that means what the procedure involves and why it is being recommended. For a photo release or a data-collection consent, specify how the images or data will actually be used. “For marketing purposes” is far weaker than “your photograph may appear on our company website and printed brochures.”

Risks, Benefits, and Alternatives

Describe any reasonably foreseeable risks or discomforts and any anticipated benefits. Research regulations require both, plus “a disclosure of appropriate alternative procedures or courses of treatment, if any, that might be advantageous.”³ One of those alternatives is always doing nothing. The same logic applies to any medical consent: a patient weighing surgery should know what happens if they choose a non-surgical approach or decline treatment entirely.

The Right to Withdraw

Say explicitly that consent is voluntary and can be withdrawn, and explain how. In regulated research the subject must be told they “may discontinue participation at any time without penalty or loss of benefits.”⁴ Even outside regulated research, a withdrawal clause strengthens the form by showing the signer had a genuine choice. If you are collecting data or ongoing permissions, explain the process for revoking consent and what happens to information already collected.

How Information Will Be Handled

Explain who will have access to the signer’s information, how it will be stored, and whether it may be shared with third parties. Research forms must include “a statement describing the extent, if any, to which confidentiality of records identifying the subject will be maintained.”³ If the form touches protected health information held by a HIPAA-covered entity, a separate HIPAA authorization meeting 45 CFR 164.508 is required, and a general consent form alone will not satisfy it.⁵

Contact Information

Give the signer a specific person to call with questions. Research forms must identify whom to contact about the study, about the person’s rights, and about any research-related injury.⁶ For non-research forms, include at least a name, phone number, and email.

Signature, Date, and Optional Witness

Include designated spaces for the signer’s printed name, signature, and date. A witness signature is not universally required; federal research rules only require a witness when a short-form oral consent process is used instead of a standard written form.² Including a witness line anyway is a common best practice because it strengthens the form’s evidentiary value if the signature is later disputed.

If your form falls under federal research regulations, additional disclosures apply. The Common Rule at 45 CFR 46 and FDA rules at 21 CFR 50 list specific required elements — including a statement identifying the activity as research, injury compensation information for studies involving more than minimal risk, and disclosures about any future use of biospecimens — and the form must be reviewed and approved by an Institutional Review Board before use.⁷ If that applies to you, work from the full element list in the regulations rather than a general template.

What a Consent Form Cannot Say

One of the fastest ways to undermine a consent form is to include language asking the signer to give up legal rights. Federal regulations prohibit this outright in research: “No informed consent, whether oral or written, may include any exculpatory language through which the subject or the representative is made to waive or appear to waive any of the subject’s legal rights, or releases or appears to release the investigator, the sponsor, the institution, or its agents from liability for negligence.” HHS defines exculpatory language broadly, as anything that has “the general effect of freeing or appearing to free an individual or an entity from malpractice, negligence, blame, fault, or guilt.”⁸ Clauses like “by signing this form, you agree not to hold us responsible for any injury” are textbook violations.

Liability waivers outside research face heavy scrutiny too. In roughly 46 states, a well-drafted waiver signed voluntarily by an adult can protect against claims of ordinary negligence, but courts interpret these waivers strictly. The most common reason they fail is ambiguous language. Many jurisdictions require the waiver to use the word “negligence” explicitly, and nearly all states refuse to enforce waivers that try to cover gross negligence, reckless conduct, or intentional harm. Courts are especially skeptical when the signer had no real bargaining power, such as when a waiver is buried in a mandatory contract for an essential service. If you want releases of liability to survive, keep them separate from the core consent provisions and draft them with a lawyer in your jurisdiction.

When the Person Signing Can’t Give Their Own Consent

Someone who lacks legal capacity cannot provide consent for themselves. The rules shift depending on whether they are a minor or an adult who lacks decision-making ability.

Minors

For children, federal research regulations use a two-part structure: parental permission plus the child’s own assent when appropriate. HHS guidance states that “one or both parents or a guardian must be provided with the information ordinarily required for informed consent… and children capable of assent must also express their willingness to participate.”⁹ There is no set age for when a child is “capable of assent”; it depends on the activity and the child’s maturity.

Who counts as a “child” varies by jurisdiction. Federal regulations define children as “persons who have not attained the legal age for consent to treatments or procedures involved in the research, under the applicable law of the jurisdiction.”⁹ In some states a 16-year-old can legally consent to certain medical treatments and would be treated as an adult for that specific context. Check the age-of-consent rules in your state for the specific activity.

Outside research, similar principles apply. A parent or legal guardian signs on behalf of a child who is too young to consent independently. The form should identify the child by name, describe the activity, and be signed by a parent or legal guardian with authority to consent.

Incapacitated Adults

When an adult cannot provide informed consent because of cognitive impairment, mental illness, or another condition, a legally authorized representative must sign on their behalf. That authority has to come from a recognized legal source: a court-appointed guardianship, a durable power of attorney, or a healthcare proxy. The form should identify the representative, their relationship to the individual, and the basis for their authority. Even when a representative signs, the individual should still participate in the decision to the extent they are able.

Writing the Form So It’s Actually Understandable

A consent form packed with jargon is not truly “informed” consent, no matter how thorough the disclosures. Federal regulations require that consent be “in language understandable to the subject” and organized “in such a way that facilitates comprehension.”³ There is no federal regulation setting a specific reading level. The often-cited 8th-grade standard is a widely adopted best practice, not a legal mandate. The actual legal standard is functional: can the person reading the form understand what they are agreeing to?

Practical moves that help:

Keep sentences under 20 words where possible. A sentence the reader has to re-read has failed its purpose.
Use everyday vocabulary. “Not recommended” beats “contraindicated.” “Lasting effects” beats “sequelae.” “Payment” beats “remuneration.”
Use clear headings so people can find what matters to them. Group risks together, benefits together, withdrawal rights together.
Write in the active voice. “We will collect your blood sample” is clearer than “A blood sample will be collected from the participant.”
Break information into short paragraphs with white space, and use bullet points for lists of risks, procedures, or rights.

After drafting, test the form. Most word processors can calculate a Flesch-Kincaid grade level; if it comes in above 9th grade, hunt for long sentences and jargon with simpler substitutes. Having someone outside your field read the form and explain it back to you is one of the most reliable checks there is.

Signing It Electronically

Consent forms signed electronically are legally enforceable. The Electronic Signatures in Global and National Commerce Act provides that “a signature, contract, or other record relating to such transaction may not be denied legal effect, validity, or enforceability solely because it is in electronic form.”¹⁰ The Uniform Electronic Transactions Act reinforces this at the state level and has been adopted in 49 states plus the District of Columbia.

For consumer-facing consent forms, E-SIGN adds specific steps before you can deliver required disclosures electronically instead of on paper. The consumer must affirmatively consent to electronic records, and before that consent you must provide a clear statement covering:

The right to receive a paper copy instead
The right to withdraw consent to electronic delivery, along with any consequences or fees for doing so
Whether the consent applies only to the current transaction or to an ongoing category of records
How to withdraw consent and update contact information
How to request a paper copy after consenting, and whether a fee applies
The hardware and software needed to access and keep the electronic records

The consumer must then confirm consent electronically “in a manner that reasonably demonstrates that the consumer can access information in the electronic form that will be used.”¹⁰ Simply clicking “I agree” on a form the person could not actually view or download does not meet that standard.

When you collect digital signatures, keep an audit trail that records who signed, when, which version of the form they saw, and their IP address or device information. That evidence is what you will reach for if the validity of the consent is ever challenged.

Keeping the Signed Form

A consent form that cannot be located when needed is nearly as useless as one that was never signed. Retention and storage are the final step in making the form actually enforceable.

Retention periods depend on the regulatory framework. For federally funded research, the Office for Human Research Protections requires records to be kept for at least three years after the study closes. FDA-regulated research must be kept for two years after either a marketing application is approved or the investigation is discontinued and the FDA is notified.¹¹ HIPAA authorizations must be retained for at least six years. When multiple regulations apply, keep records for the longest required period.

Outside research, retention varies. Medical records are governed by state law, with most states requiring records be kept for at least five to ten years. Business consent forms tied to data collection should be retained for at least as long as you are using the person’s data, and ideally for several years after that in case of a dispute. When no specific rule applies, err on the side of keeping records longer.

Signed forms directly link an individual to an activity, which makes them sensitive. Store paper forms in locked cabinets with access limited to authorized personnel. Store electronic forms on encrypted, access-controlled systems, not on shared drives, personal devices, or unencrypted portable media. Update access permissions as staff changes, and track who views the records.

Finally, treat the form as a living document. HHS guidance directs that consent processes should be “revised when deficiencies in its accuracy or completeness are noted, when new information about reasonably foreseeable risks and potential benefits becomes available, or when other additional information becomes known that will improve the consent process.”² Review your form at least annually and whenever the activity, the applicable regulations, or your organization’s practices change. When you update the form, re-consent anyone currently participating under the old version.

1
National Institutes of Health. Research Involving Individuals with Questionable Capacity to Consent
2
U.S. Department of Health and Human Services. Informed Consent FAQs
3
eCFR. 45 CFR 46.116 – General Requirements for Informed Consent
4
Office for Human Research Protections. Guidance on Withdrawal of Subjects from Research
5
eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
6
eCFR. 21 CFR 50.25 – Elements of Informed Consent
7
U.S. Food and Drug Administration. Institutional Review Boards Frequently Asked Questions
8
U.S. Department of Health and Human Services. Guidance on Exculpatory Language in Informed Consent
9
HHS.gov. Research with Children FAQs
10
Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
11
National Institutes of Health. Record Retention