Don't type personal details, such as a client's name.

Asking Clients for Consent

Have clients agree to a privacy notice in your agency's name on their client link before they answer anything, with a record of their consent on the form.

Your clients’ DS-160 answers include their health and criminal history, and under the GDPR you, as the controller of their data, need a lawful basis for that, usually their explicit consent. You can have the client link ask for it: before the client can see or answer anything, they read a privacy notice in your agency’s name and tick one box to agree.

Before you start

  • Who can do it: Owners and Admins of a Business workspace.
  • It is off by default: links only ask for consent when you turn it on.
  • Read the two pages first: you adopt the privacy notice and the page on how data is processed as your notice to these clients (see What your client sees below).

Turn it on

  1. Open Workspace Settings → Client intake and find Client consent.
  2. Tick Ask for consent on new client links.
  3. Click Save.
Example: how this looks on the platform

This is the default for links created from then on. Links you have already sent keep working as they did. When you create or email a link, Ask the client for consent first starts ticked, and you can untick it for that one link (or tick it on a link while the setting is off). Links created through the API follow the setting unless the request sends requireConsent.

What your client sees

On a link that asks for consent, the client first sees a Before you start screen, under your branding, with:

  • a link to the privacy notice, which says what is collected, why, who receives it and their rights;
  • a link to how their data is processed, which describes your software provider, the agreement it works under and how it protects their data;
  • one box to tick, which names their answers about health and criminal history so the consent is explicit.
Example: how this looks on the platform

Until they agree, the link shows nothing else and accepts no answers, documents or messages. If they choose I do not agree, nothing is recorded and they are asked to contact you.

We write both pages, so you do not have to draft a notice of your own. Your agency name and the contact details from Workspace Settings → Branding are filled in; the rest of the wording is the same for every workspace, and there is no way to upload your own notice or link to one instead. The pages call you “we” and refer to us only as “a software provider”. Each client’s consent record notes which version of the notice they agreed to. Read the pages before you turn consent on: you adopt them as your notice to these clients and remain responsible for them. Without an agency name, or on a link that hides branding, the pages refer to “the business that sent you this link”.

How we process your clients’ data on your behalf is set out in our Data Processing Agreement. Questions about the wording go to privacy@ds160.io.

Once the client agrees

The client is asked once per form. Another link for the same form does not ask again.

The form’s overview shows when the client agreed, and the address the link was sent to. We keep the time, the version and language of the notice, and the browser they used, but not their IP address. The API’s form endpoint returns the same record.

With a group link, a group’s lead fills in forms for other people, such as their children. On a group link that asks for consent, the lead agrees on each form, on the applicant’s behalf. The screen names the applicant, and the box says the lead may act for them (as their parent or guardian, or because the applicant asked them to) and will tell them how their information is used. The privacy notice says a lead may agree this way.

That consent counts only for the group link. If the applicant opens a client link of their own, for example once their form is set to be filled in by the applicant, they are asked to agree for themselves.

To have adults always fill in and agree for themselves, tick Adults in a group fill in and agree for themselves under Workspace Settings → Client intake → Groups. The lead’s link then opens only the forms of applicants under 18.

If the client withdraws

Every page of the link has Withdraw consent at the bottom. When a client withdraws, their link can no longer change the form unless they agree again, and the workspace’s Owners and Admins get an email. Nothing is deleted: if the client wants their information erased, email privacy@ds160.io and we delete it within 30 days. The form’s overview shows the withdrawal until they agree again.

Expected result

New client links open on the Before you start screen. Once the client agrees, the form’s overview shows when they agreed and the address the link was sent to; until then it says it is waiting for the client to agree.

Troubleshooting

ProblemWhat to do
A client was not asked for consentThe link was made before you turned consent on, Ask the client for consent first was unticked for that link, or the client already agreed on this form: they are asked once per form.
“Waiting for the client to agree to the privacy notice on their link.”The client hasn’t agreed yet. Until they do, the link shows nothing else and accepts no answers, documents or messages.
The client chose I do not agreeNothing is recorded and they are asked to contact you.
The overview says the client withdrew their consentTheir link cannot change the form unless they agree again. If they want their information erased, email privacy@ds160.io.
The pages say “the business that sent you this link”The workspace has no agency name, or the link hides branding. Add your agency name under Workspace Settings → Branding.
An applicant is asked to agree although their group’s lead didA lead’s consent counts only for the group link. On a client link of their own, the applicant agrees for themselves.