Your contact form is often the most important thing on your website and the least audited. It creates two problems that are really one: a compliance obligation, because every form collects personal information under the Australian Privacy Principles, and a hidden cost when the form fails or drops the source data. This guide covers what your form is actually doing, and the fix that closes both gaps at once.
The form on your contact page is probably the most important thing on your website and the least audited. It is how people reach you, how quotes come in, how leads arrive, and for most businesses it has not been looked at properly since the day it was pasted in.
That matters for two reasons that usually get treated separately and are actually the same problem. The first is compliance. Every contact form, quote request and newsletter signup collects personal information, and under the Australian Privacy Principles that collection carries obligations: how you notify people, how you handle what they send, how you keep it. Those obligations apply to the form on your contact page just as much as to anything on your internal network.
The second reason is the one that should get attention fastest, because it costs you money every week: the same setup that raises the privacy question is quietly losing you leads.
The short version. A contact form is a point of collection, and collecting personal information brings duties around notice, handling and storage. The form is also usually served from a provider’s domain, which lets a consent tool hide it until someone accepts cookies. Fix the consent setting now. Serve the form from your own domain, and its visibility stops depending on what a visitor does with the banner.
What your form is actually doing
Start with what it asks for. A name, an email address, a phone number, and a free-text box where people type things you never asked for. Once submitted, all of that is personal information you have collected, and collection is exactly what the Australian Privacy Principles are written about.
Then look at where it lives. The form is very likely an embed, a snippet someone pasted in years ago that pulls the form from a provider such as js.hsforms.net or form.jotform.com. What visitors type goes through that provider’s systems, so answering “how do you handle what people send” starts with knowing which provider that is.
The provider’s domain has a second consequence. Consent tools such as Cookiebot, Usercentrics and OneTrust sort scripts by where they load from, and anything served from outside your domain waits for consent. A form served from a provider’s domain gets sorted in with the tracking pixels.
The cost you never see in your analytics
A visitor who ignores the banner has given no consent, so a blocked form stays blocked for as long as they are on the site. Most visitors do exactly that. The ones affected are the people who opened the contact page because they wanted to send you something.
The loss does not announce itself. Those visitors are often untracked for the same reason the form is hidden, so no chart dips. What you get is a quieter inbox and no explanation for it.
If you pay to bring people to that page, part of that budget now ends at a grey box. No report flags it, and nobody complains, because the people who would have complained could not reach the form.
Nobody on that page was browsing. They had come to hand over their details, which is exactly the act the privacy rules exist to govern.
The compliance angle most businesses get backwards
The cookie banner and the privacy obligation tend to get filed as one job. They are separate. Cookie consent concerns what gets stored on a visitor’s device for tracking and marketing. A contact form stores nothing by being displayed, and information only moves when someone presses submit, by choice. The obligation that attaches to the form concerns what arrives after that press: telling people what you collect, looking after it, and keeping it properly.
So putting the form behind the banner guards against nothing the banner is for, and leaves the real obligation where it was. The correction is a setting in your consent tool: classify the form’s service as functional or essential rather than marketing, or allowlist its domain. It costs nothing and takes minutes.
Settings like that do not always stay put:
- It is per site and per form. Each new embed arrives blocked until someone remembers to reclassify it, and on a portfolio of sites someone has to keep remembering.
- Updates can undo it. A consent-tool upgrade or an imported configuration can put the form back behind the banner without telling anyone.
- Not every blocker honours the allowlist. Some go on holding a provider’s files after the setting says otherwise.
The fix that closes both gaps at once
Both halves of this start in the same place, a form served from somebody else’s domain. Serve it from yours and the consent tool sees part of your own site, which is what it is.
With nothing foreign to hold back, the form loads for every visitor, whatever they did with the banner. Because the change is in where the form lives rather than in a setting, a consent-tool update cannot quietly reverse it. Tracker blockers and Safari’s Intelligent Tracking Prevention, which also key on third-party domains, have nothing to catch either.
On the privacy side, you stop asking visitors for cookie consent on something that never needed it. What remains is the obligation that applied all along, notice, handling and storage of what people send, and that is the same broad duty whether you work to the Australian Privacy Principles, GDPR or UK GDPR.
First-party delivery is also what keeps lead source data intact when trackers and ITP are in play. Lead Source serves your forms first-party and records the real source of each enquiry; see lead source tracking. The step-by-step version, with the consent-tool patch and the permanent setup, is in why your cookie consent tool is blocking your contact forms.
Put it on the radar
Two checks, both quick. For visibility, open the contact page in a private window, refuse cookies and look for the form. If it is missing, you have your answer. For the obligation, list what the form asks for, note which provider receives it, and read your privacy notice to see whether it covers both.
A contact form is where people hand over their details on purpose. It should load for every one of them, and you should be able to say what happens to those details next.