Consent is an action, not a preamble
A line in the introduction — «by continuing you accept the privacy policy» — isn't an action by the respondent: it's a sentence that crossed the screen. Consent needs a separate, voluntary gesture, and it needs to stay distinguishable from the rest of the answers.
That's why there's a question type for it: the text above, two buttons below, and the answer stored like all the others with its timestamp. It isn't a cosmetic formality — it's the difference between being able to say *what* was accepted and *when*, and not being able to.
The text has to say three things
Who: who's collecting the data, by name, not «we». What for: the specific purpose — sending the newsletter, running the event, following up on a quote — not «for marketing and related purposes». For how long and how to undo it: the unsubscribe link, the address to write to.
If there are two purposes (say: running the event *and* sending future communications), you need two separate consents. Putting them in one box invalidates even the part that would have been fine on its own.
Ask for fewer fields, not more consents
The question you don't ask is the data you don't have to protect, store, export or delete. Before adding a consent, check whether you can remove a field: a phone number you'll never use is risk with no upside.
This goes double for sensitive data — health, opinions, memberships. If you genuinely need it, you also need safeguards that go beyond a form; if you don't, the safest choice is not having it.
What you need to be able to find later
If someone disputes a signup, what you need is: the date, the exact text they accepted, and the fact that they did so actively. You have the first two if consent is a question; you have the third if it wasn't pre-ticked.
One last point about attachments: a form that accepts files can receive identity documents even when you didn't ask for them. If you don't need them, say so next to the field — it's the only defence that works.
Consent is a separate question containing who, what for and how to undo it — and every field you don't ask for is data you don't have to protect.