Don't type personal details, such as a client's name.
Asking Clients for Consent
Have clients agree to a privacy notice in your agency's name on their client link before they answer anything, with a record of their consent on the form.
Your clients’ DS-160 answers include their health and criminal history, and under the GDPR you, as the controller of their data, need a lawful basis for that, usually their explicit consent. You can have the client link ask for it: before the client can see or answer anything, they read a privacy notice in your agency’s name and tick one box to agree.
Prerequisites. This is for Owners and Admins of a Business workspace. It is off by default: links only ask for consent when you turn it on.
Turn it on
Open Workspace Settings → Client intake and find Client consent. Tick Ask for consent on new client links and Save.
This is the default for links created from then on. Links you have already sent keep working as they did. When you create or email a link, Ask the client for consent first starts ticked, and you can untick it for that one link (or tick it on a link while the setting is off). Links created through the API follow the setting unless the request sends requireConsent.
What your client sees
On a link that asks for consent, the client first sees a Before you start screen, under your branding, with:
- a link to the privacy notice, which says what is collected, why, who receives it and their rights;
- a link to how their data is processed, which describes your software provider, the agreement it works under and how it protects their data;
- one box to tick, which names their answers about health and criminal history so the consent is explicit.
Until they agree, the link shows nothing else and accepts no answers, documents or messages. If they choose I do not agree, nothing is recorded and they are asked to contact you.
We write both pages, so you do not have to draft a notice of your own. Your agency name and the contact details from Workspace Settings → Branding are filled in; the rest of the wording is the same for every workspace, and there is no way to upload your own notice or link to one instead. The pages call you “we” and refer to us only as “a software provider”. Each client’s consent record notes which version of the notice they agreed to. Read the pages before you turn consent on: you adopt them as your notice to these clients and remain responsible for them. Without an agency name, or on a link that hides branding, the pages refer to “the business that sent you this link”.
How we process your clients’ data on your behalf is set out in our Data Processing Agreement. Questions about the wording go to privacy@ds160.io.
Once the client agrees
The client is asked once per form. Another link for the same form does not ask again.
The form’s overview shows when the client agreed, and the address the link was sent to. We keep the time, the version and language of the notice, and the browser they used, but not their IP address. The API’s form endpoint returns the same record.
If the client withdraws
Every page of the link has Withdraw consent at the bottom. When a client withdraws, their link can no longer change the form unless they agree again, and the workspace’s Owners and Admins get an email. Nothing is deleted: if the client wants their information erased, email privacy@ds160.io and we delete it within 30 days. The form’s overview shows the withdrawal until they agree again.