Lead Form Consent Wording for the UAE: What to Say Before You Call, WhatsApp or Email
Quick answer
A UAE lead form should say who will contact the person, by which channel, about what, and how to stop. Put marketing email and WhatsApp offers in separate unticked boxes. Store the date, the exact words, the person's details and the form version, because the PDPL puts the burden of proving consent on you.
Legal caveat
What do the UAE rules ask of a lead form?
| Requirement | Where | What it means for the wording |
|---|---|---|
| You can prove the consent | <a href="https://privacyarabia.com/wp-content/uploads/2022/08/Decree-Law-45-2021-Data-Protection-Law-English.pdf" target="_blank" rel="noopener">PDPL</a> Article 6(1)(A) | Keep a record of what the person saw and when. A form with no stored wording leaves you unable to prove anything. |
| Clear, simple, unambiguous, easily accessible | PDPL Article 6(1)(B) | Plain sentences next to the button, not a clause inside a long terms page. If your visitors read Arabic, show the same sentence in Arabic. |
| Says they can withdraw, and withdrawing is easy | PDPL Article 6(1)(C) | Put the way to stop in the sentence itself: reply STOP, click unsubscribe, or tell the caller. |
| A specific and clear purpose | PDPL Article 5(2) | Name the use. Details collected for a callback may not later be used in an incompatible way, such as a marketing list. |
| Tell them before you process | PDPL Article 13(2) | Before processing starts the person gets the purposes, who the data is shared with, and the protection measures for any transfer outside the UAE. |
| Marketing messages follow an opt-in | <a href="https://tdra.gov.ae/-/media/About/regulations-and-ruling/EN/Unsolicited-Elrctronic-Commuincations--pdf.ashx" target="_blank" rel="noopener">TDRA policy</a> Articles 1.8, 6.8 | Opt-in means that if the person does not give consent, they are treated as not having given it. A pre-ticked box fails that test in our reading. |
| A way for interested people to reach you | <a href="https://uaelegislation.gov.ae/en/legislations/2519" target="_blank" rel="noopener">Cabinet Resolution 56 of 2024</a> Article 4(4) | Telemarketing companies set up a channel for consumers who want marketing information and market only to them. A lead form is that channel. |
Rule. The TDRA policy addresses licensed telecom operators, and Resolution 56 addresses companies that market by phone, text and social media messages (Article 1). Practice. We treat the TDRA record fields as the standard a regulator would hold a list to, even where the policy is not aimed at you. We did not find a statute that prints the exact words a lead form must use, so what follows is drafting, and the test is the PDPL's: clear, provable and easy to withdraw.
What wording can you copy?
Four lines cover most lead forms. Replace the placeholders in square brackets. Only the first is a statement under the button. The next two are boxes the visitor ticks, and both must start empty.
| Purpose | Line | How it appears |
|---|---|---|
| A call or WhatsApp about their own request | By sending this, you agree that [Business] may call or WhatsApp you about your request. We use your details for that. To stop, tell us and we will stop. | A sentence above the send button. |
| Marketing email | Send me news and offers from [Business] by email. You can unsubscribe at any time. | Unticked box, separate from the line above. |
| Marketing on WhatsApp | Send me offers from [Business] on WhatsApp. Reply STOP at any time. | Unticked box. Use it only if you will send offers there. |
| Privacy | We keep your details only as long as we need them for your request. We share them with [categories of people or tools, for example our CRM provider]. You can ask us to show, correct or delete them at [address]. | A line under the button, linked to your privacy page. |
The second and third lines are separate on purpose. Rule. UK GDPR Article 7(2) says a consent request inside a wider document must be clearly distinguishable from other matters, and Article 7(4) asks whether a service was made conditional on consent it does not need (text). That is a UK rule, not a UAE one, and we cite it as a sound design test. Practice. Never make the marketing box a condition of getting a quote or a callback.
What should you store with each lead?
Rule. The TDRA policy says a consent record holds the date, the time, the words or content by which the person agreed, and their identity. It adds the IP address for consent given online and the phone number for consent given by phone (Article 6.6). It must be storable and producible to the regulator on request (6.3), and is kept for the whole period you market to that person (6.7).
- The exact words of every line the person saw, and a version label for each, so you can show which wording applied on which date.
- Which boxes were ticked, one value per channel, never a single yes.
- Date and time, in one time zone you state (Gulf Standard Time, UTC+4).
- Who: the name, phone number and email as typed.
- Where from: the form or page address and, for an online sign-up, the IP address.
- Later changes: the date of any unsubscribe or STOP, so the contact is not made again.
What does the MAJ Leads lead link say?
The lead link page in the Console code, as we read it on 4 November 2026, shows this English line above the send button: "By sending this you agree that [business] may call or WhatsApp you about your request. Your details are used for that and nothing else." It also has an optional email field with a separate unticked box, "Send me news and offers from [business] by email. You can unsubscribe at any time." The page exists in English, Arabic, Hindi and Urdu.
On submit it stores that consent was given, the time, and a version label for the wording. For the email box it stores the exact sentence, its version, the IP address and the source, and only when an address was given and the box was ticked. Sending is the agreement for the call; whether that is enough under Article 6 is our reading and counsel should confirm it. If you use another form tool, MAJ Leads lets an admin map one field as the marketing opt-in box, confirm the wording shown beside it and confirm that the box starts unticked. Without that mapping no marketing consent is recorded.
WhatsApp auto-reply is rolling out and WhatsApp broadcast is coming soon, so the marketing WhatsApp line above is wording for when you send offers there. The calling rules that follow a form are in the guide to calling a web lead within 30 seconds, and the WhatsApp side is in WhatsApp opt-in. When a person asks to see or delete what you hold, use the PDPL request procedure.
Does the UK differ?
Rule. PECR regulation 22 bars unsolicited marketing email to individual subscribers unless they agreed earlier, with a soft opt-in for a sender's own customers when the contact details came from a sale or negotiation for a sale, the marketing covers similar products and services, and an opt-out was offered free of charge at collection and in every message. UK GDPR Article 7 adds that you must be able to demonstrate consent and that withdrawing must be as easy as giving it. The same unticked boxes and stored wording meet both regimes.
See how it works and pricing.
Sources
- UAE Federal Decree-Law 45 of 2021 on personal data protection (English text, Lexis Middle East)
- TDRA Regulatory Policy: Unsolicited Electronic Communications, Version 1.0 (30 December 2009)
- UAE Cabinet Resolution 56 of 2024 on telemarketing (UAE Legislation portal)
- UK Privacy and Electronic Communications Regulations 2003, regulation 22 (legislation.gov.uk)
- UK GDPR Article 7, conditions for consent (legislation.gov.uk)
Frequently asked questions
Do I need a checkbox on a UAE lead form?
Can I pre-tick the marketing box?
What must I store as proof of consent?
Does the PDPL give exact wording for the consent line?
Does a lead form consent allow me to add the person to a newsletter?
Anam Jalal
Founder & CEO, MAJ Leads
Anam Jalal is the founder of MAJ Leads, a Dubai-based lead management system that puts every paid lead on a rep's phone within about thirty seconds and chases it until it has an answer. He works hands-on with UAE clinics, brokerages and trading companies on lead follow-up, WhatsApp and CRM integrations, and ran voice AI deployments in the UAE before the company focused on lead management.
Read more about AnamRelated articles
Compliance
Double Opt-In vs Single Opt-In: What the UAE, UK and US Rules Require for Email
Marketing tools push double opt-in as if the law demanded it. We read the UAE, UK and US texts. None requires a confirmation click, all but the US require consent, and the real duty is proof. This guide shows what that means for a newsletter list.
Compliance
WhatsApp Opt-In: What Counts as Consent and How to Log Proof of It
Every vendor says to get explicit consent. Meta's own opt-in page is shorter and more specific than that, and it says nothing about record-keeping. Here is the exact rule, what is our practice instead, and a log row you can copy.