Written consent is a signed, dated document in which a person voluntarily authorizes a specific action after being told enough to make a real decision about it. Several federal laws require written consent before anyone can pull your credit report for a job, send prerecorded marketing calls to your cell phone, collect data from your child online, or share your medical records outside of your treatment. Separate from those statutes, an old contract doctrine called the Statute of Frauds forces certain agreements (real estate deals, long-term contracts, guarantees of someone else’s debt) to be put in writing before a court will enforce them. When the writing is missing or defective, the consequences range from a voided contract to statutory damages running into the thousands per violation.
What Makes a Signed Form Actually Count
A name at the bottom of a page is not the end of the inquiry. Courts and regulators look for a handful of elements before treating written consent as valid.
- Clear scope. The document has to spell out what the person is agreeing to, for what purpose, and, where relevant, for how long. Vague or open-ended language invites challenges.
- Voluntary agreement. Consent given under pressure, threats, or deception doesn’t count. The signer must be free to refuse without penalty, unless a specific law allows a benefit to be conditioned on consent.
- Legal capacity. The signer must be able to understand what they’re agreeing to. Minors, people under guardianship, and individuals with certain cognitive impairments generally cannot consent for themselves.
- Adequate information. Enough detail to make a genuine decision. In healthcare, that means risks, benefits, and alternatives. In data privacy, it means what will be collected and how it will be used.
- Signature and date. A signature ties a specific person to the agreement at a specific moment. Some contexts also require a witness or notary, though most everyday consent forms do not.
When someone can’t sign for themselves, another person often can. A parent signs for a minor child. An agent holding a durable power of attorney can authorize medical decisions or financial transactions for an incapacitated adult, provided the power of attorney grants that specific authority. The agent has to act within the scope of the document, and the party receiving the signature is generally entitled to confirm the authority is still in effect.
Federal Laws That Require Written Consent
Several major federal statutes refuse to leave the format up to the parties. They require written or verifiable consent before certain actions can happen at all.
Employment Background Checks
Before an employer can pull a background report on a job applicant, the Fair Credit Reporting Act requires two things: a clear written disclosure that the employer intends to obtain the report, and the applicant’s written authorization permitting it. The disclosure has to be simple and standalone. Employers cannot bury it inside a general job application or weigh it down with liability waivers, accuracy certifications, or sweeping release language.1Federal Trade Commission. Background Checks on Prospective Employees: Keep Required Disclosures Simple
If the report turns up something that might cost the applicant the job, the employer must give them a copy of the report and a reasonable window to dispute errors before making a final decision. Skipping any of these steps triggers liability under the FCRA, and class actions over technical disclosure violations have become routine.
Telemarketing and Robocalls
The Telephone Consumer Protection Act restricts automated and prerecorded calls. The FCC requires prior express written consent before a company can send prerecorded telemarketing calls to a wireless number. The written consent has to clearly authorize the specific caller to deliver the specific type of message. A generic “I agree to be contacted” buried in terms of service does not satisfy the rule if it fails to identify the caller and the nature of the calls.
The TCPA allows a private lawsuit with statutory damages of $500 per unauthorized call or text, and a court can triple that to $1,500 per violation if the caller acted willfully.2Federal Communications Commission. Telephone Consumer Protection Act 47 USC 227 A single marketing blast to a purchased list can generate thousands of individual violations, which is why TCPA class actions regularly produce multimillion-dollar settlements.
Children’s Online Privacy
The Children’s Online Privacy Protection Rule requires websites and apps to obtain verifiable parental consent before collecting personal information from children under 13. The consent has to come from the parent, not the child, and the operator must make reasonable efforts to confirm the person giving consent actually is the parent.3eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule
Acceptable verification methods include a signed and returned consent form, a credit card transaction that generates a notification, a phone or video call with trained personnel, or a check of a government-issued ID against a database. Recent amendments to the rule, with a compliance deadline of April 22, 2026, also allow knowledge-based authentication questions and text-message verification.3eCFR. 16 CFR Part 312 – Children’s Online Privacy Protection Rule
Health Information Sharing Under HIPAA
HIPAA is widely misunderstood on this point. The Privacy Rule does not require written consent for a doctor to treat you or share your records with another provider for treatment purposes. Using and disclosing health information for treatment, payment, and healthcare operations is permitted without a signed form. Hospitals and clinics may collect consent for those uses, but federal law makes it optional.4U.S. Department of Health and Human Services (HHS). Summary of the HIPAA Privacy Rule
Where HIPAA does require a signed document is for uses that go beyond treatment and payment. Sharing your health records with a life insurance company, a marketing firm, or a researcher requires a written authorization. This is more detailed than a simple consent form. It must name who is authorized to disclose the information, name who will receive it, describe the specific information covered, state the purpose, and carry an expiration date. The authorization must also inform you of your right to revoke it in writing at any time.5eCFR. 45 CFR 164.508 – Uses and Disclosures for Which an Authorization Is Required
The split between consent and authorization trips up patients and providers alike. If a form asks you to authorize release of your records to someone outside your care team, that’s the HIPAA authorization, and it has to meet every regulatory requirement to be valid.6HHS.gov. What Is the Difference Between Consent and Authorization Under the HIPAA Privacy Rule
Contracts the Statute of Frauds Forces Into Writing
Outside the specific consent statutes, the Statute of Frauds requires certain categories of agreement to be in writing and signed before a court will enforce them. The rule exists to prevent people from fabricating the terms of high-stakes deals after the fact. Details vary by state, but five categories appear almost everywhere:
- Real estate transactions, including any contract for the sale or transfer of land or an interest in land.
- Contracts that cannot be fully performed within one year of being made.
- Promises to pay someone else’s debt if that person defaults.
- Contracts made in consideration of marriage, including prenuptial agreements.
- Sales of goods worth $500 or more, under the Uniform Commercial Code.7LII / Legal Information Institute. UCC 2-201 Formal Requirements Statute of Frauds
The writing doesn’t have to be a formal contract. A signed letter, an email, or a text message chain can satisfy the requirement in some jurisdictions, as long as it identifies the parties, describes the essential terms, and bears the signature of the party being held to the deal. The point is that something exists on paper, or its digital equivalent, proving the deal was made.
Electronic Signatures and Digital Consent
Clicking “I agree,” typing your name into a signature field, or drawing your signature on a touchscreen all qualify as legally valid signatures under federal law. The Electronic Signatures in Global and National Commerce Act, known as the ESIGN Act, establishes that a signature or contract cannot be denied legal effect solely because it is electronic.8Office of the Law Revision Counsel. 15 USC 7001 – General Rule of Validity
Nearly every state has layered on a parallel framework: 49 states and the District of Columbia have adopted the Uniform Electronic Transactions Act, and New York has enacted its own statute giving electronic signatures the same legal weight. The practical result is that electronic consent is enforceable throughout the United States, provided the signer clearly intended to sign and agreed to conduct business electronically.
For an electronic signature to hold up, the workflow should capture the signer’s intent (a deliberate click on a clearly labeled “Sign” button, for example), keep a complete and reproducible copy of the signed document, and give each party access to the executed version. For high-stakes transactions such as loan agreements or HIPAA authorizations, an audit trail showing when and how the signature was captured matters a great deal if the agreement is ever challenged.
What Goes Wrong When Written Consent Is Missing
Consequences depend on which consent was skipped.
In telemarketing, the math is per violation. Each unauthorized call or text can cost $500, with willful violations reaching $1,500.2Federal Communications Commission. Telephone Consumer Protection Act 47 USC 227 Companies that send bulk messages without proper prior express written consent routinely face class actions with eight- or nine-figure exposure.
In healthcare, performing a procedure without any patient consent can give rise to a battery claim, an intentional tort, rather than a simple negligence case. Battery applies when a doctor performs a procedure the patient never agreed to, or performs a substantially different one than was authorized. When the patient agreed to the procedure but was not adequately informed about its risks and alternatives, the claim sounds in negligence for lack of informed consent. The distinction matters because battery claims can carry different damage rules and may not require expert testimony to prove.
In employment, running a background check without the required FCRA disclosure and written authorization exposes the employer to statutory damages and class action liability. Courts have shown little patience for technical violations like bundling the disclosure with other hiring paperwork or including prohibited waiver language.1Federal Trade Commission. Background Checks on Prospective Employees: Keep Required Disclosures Simple
For contracts governed by the Statute of Frauds, the result is simpler. Without a signed writing, the agreement is unenforceable. You might have a legitimate deal, but if the other party walks away and nothing was ever put in writing, a court will generally refuse to order performance or award damages.
How to Withdraw Written Consent
Signing a consent form does not lock you in permanently. In most contexts, you can revoke written consent going forward. Revocation only works prospectively: anything already done while the consent was valid remains lawful. You cannot undo a background check that was already completed or claw back health information that was already shared under a valid authorization.
Under HIPAA, the right to revoke an authorization is built into the regulation. Every authorization form must inform you of the right, and the revocation isn’t effective until the covered entity actually receives it in writing. If you signed the authorization through a third party, sending the revocation to that third party is not enough. The organization holding your data has to receive it directly.9HHS.gov. Can an Individual Revoke His or Her Authorization
Processing deadlines depend on the law. Under the CAN-SPAM Act, when you opt out of commercial emails, the sender has to stop sending within 10 business days of receiving the request, and the opt-out mechanism itself must remain functional for at least 30 days after the original message was sent.10Office of the Law Revision Counsel. 15 USC 7704 – Other Protections for Users of Commercial Electronic Mail Other laws don’t give an exact timeline and instead require action within a “reasonable” period, which leaves room for dispute when an organization drags its feet.
As a practical matter, always revoke in writing, whether by email, letter, or the organization’s designated form, and keep a timestamped copy. Verbal revocations are harder to prove, and in some regulatory contexts a written revocation is the only kind that counts.