Do users need to accept a privacy policy?

Generally, no. Under GDPR, a privacy policy informs people about data processing; there is no general requirement for users to tick an “I accept” box simply to receive that information.

Three actions should be distinguished:

• Providing notice: Explaining your practices at the required time.

• Acknowledging notice: Recording that someone has seen or read the information.

• Giving consent: Agreeing to a specific processing purpose where consent is the legal basis.

An acknowledgement does not itself provide consent. Consent requests must be specific, informed, freely given, and unambiguous, with an affirmative action and a way to withdraw.

Processing may instead rely on another lawful basis for processing, such as contractual necessity or a legal obligation. The ICO’s consent guidance explains why permission is not required for every use of personal data.