Glasgow charity donation funnel consent and accessibility

What to take away

Question one: what lawful basis covers a Glasgow charity donation funnel

Start with the purpose, not the form. A donation funnel does two jobs: it takes a gift, and it creates a relationship you may want to continue. Each job needs its own lawful basis under UK GDPR.

When you choose or configure donation-funnel software, make those separate purposes visible in the form and in the records it stores.

For processing the donation itself, most Glasgow charities rely on contract or legitimate interests. The person is giving money and you must process the payment, issue a receipt and keep financial records. That is straightforward.

For follow-up marketing, the rules depend on the channel. Regulation 22 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR) covers unsolicited marketing by electronic mail; regulation 21 covers unsolicited live marketing calls. Configure and review each channel separately.

The Direct marketing guidance | ICO covers valid consent for charity enquiries. Read it before you write the form copy.

Many Scottish charity funnels mix the two. A single unticked box that says "keep me updated" covers nothing if the wording is vague. Name the channel and the type of message.

A Glasgow housing association running a hardship appeal has a different basis from a national medical research charity.

If you sell or swap donor data, stop. Consent for one charity does not transfer to another, and PECR penalties are real. Your PECR and subscriptions notes should sit beside the form spec.

Ask your supplier one question: which lawful basis is recorded for each field? If they cannot answer, the funnel is not ready.

Examples of software routes include a WordPress site using the GiveWP donation plugin, or hosted fundraising pages on JustGiving. These are examples, not compliance endorsements; assess the actual form and data flow you use.

Question two: is the donation form accessible under WCAG 2.2

Donation form accessibility is not a nice-to-have. It is a legal expectation under the Equality Act 2010, and WCAG 2.2 is the benchmark most auditors use.

The Web Content Accessibility Guidelines (WCAG) 2.2 success criteria for the donation form are specific. Check labels, error identification, focus order, target size and redundant entry first. Relevant criteria include 2.1.1 Keyboard, 2.4.3 Focus Order, 2.5.8 Target Size (Minimum), 3.3.1 Error Identification and 3.3.2 Labels or Instructions. WCAG 2.2 sets a minimum target size of 24 by 24 CSS pixels.

WCAG 2.2 added criteria that catch charity forms often. Check 3.3.7 Redundant Entry, as well as dragging movements, consistent help and accessible authentication where your funnel uses a slider, a chat widget or a password step.

Keyboard access is the fastest test. Tab through the whole form without a mouse. If the amount selector, the Gift Aid box or the submit button cannot be reached, fix that before launch.

Screen reader users need labels tied to inputs. A placeholder is not a label. An asterisk is not an explanation. Write the label so it makes sense read aloud.

Error messages must say what went wrong and how to fix it. "Invalid input" fails. "Enter your postcode in the format G1 1AA" passes.

Colour contrast matters on the button and the error text. WCAG 2.2 success criterion 1.4.3, Contrast (Minimum), requires a contrast ratio of at least 4.5:1 for normal text. Charity brand palettes often use pale greys and light greens that fall below the required ratio.

The Guidance and tools for digital accessibility - GOV.UK is a practical starting point for testing and procurement questions. Use it when you brief a Glasgow agency. Automated checkers such as WAVE and axe DevTools can help identify issues, but they do not replace keyboard and screen reader checks.

Accessibility is also a release issue. Put it in your release checklist so no one ships a form that fails a keyboard test.

Question three: how should donation-funnel software preserve consent and reporting records

Donation-funnel software is part of the record-keeping workflow, not a substitute for it. OSCR reporting is the Scottish charity regulator's annual return, and it relies on accurate accounts and a trustees' annual report. Plan how the funnel's records will feed into those processes.

Donation income from a Glasgow funnel must be recorded in your accounting records. Check that your software can provide a usable audit trail from payment processor to bank statement to annual return.

If your funnel collects Gift Aid, you need a declaration from the donor and a record of it. HMRC rules apply across the UK, and OSCR expects the charity's accounts to match. Check how the platform records the declaration and how staff can retrieve it.

If the funnel changes how you raise funds, note it in the trustees' annual report. OSCR wants to see how fundraising is governed, not just how much came in. Keep the relevant information accessible to the staff preparing the report.

Consent records are part of this. If you cannot show when and how a donor opted in, you cannot rely on that consent later. Check that your software stores the wording, timestamp and source, and lets you retrieve them.

A material change in fundraising activity may need to be reported. OSCR's annual return is due within nine months of your charity's financial year end. Make sure your reporting process can use the records exported from the funnel.

Set a quarterly review. Compare the funnel's consent records against the ICO direct marketing checklist and against your OSCR return notes. Test that a sample export is complete and fix gaps while they are small.

Put export of consent events in the software requirements and test a sample before launch. Read the service standards for landing pages as a procurement prompt, and agree with the supplier who provides the export and how it is delivered.

PECR consent and the ICO direct marketing checklist for charities

PECR consent charity rules are stricter than many digital leads assume. PECR covers email, text, phone and some online tracking. It applies even when the charity is not selling anything.

A soft opt-in can cover existing donors, but it is narrow: it applies only to similar messages, and you must offer an opt-out when you collect the details and in every message.

The Direct marketing checklist | ICO is a practical audit tool. It asks whether consent is freely given, specific, informed and unambiguous, and whether you can prove it.

Run it against your Glasgow funnel once a quarter. Open the form, read the consent wording, check the record and test the unsubscribe path.

Common failures are predictable. Pre-ticked boxes, bundled consent, vague wording, no proof of opt-in and no clear way to withdraw.

Withdrawal must be as easy as giving consent. If opting in takes one click, opting out should not take a phone call during office hours.

If you use a third-party platform, the consent record must be yours. You are the controller. The processor's dashboard is not your evidence file.

Document the decision. A short note explaining why you chose PECR consent for email and legitimate interests for receipting is worth more than a long policy nobody reads.

Pair that note with a disclosure procedure covering tracking pixels, embedded videos and any AI-assisted chat on the form.

Glasgow charity donation funnel consent checklist

Use this before launch and again after any change to the form or the platform.

Worked example: a Glasgow food bank appeal

A Glasgow food bank configures a winter appeal donation funnel in its chosen software. The form takes a one-off gift and asks for email updates.

The team names contract as the basis for the gift and PECR consent for the updates. The consent box is unticked and names email only. The wording reads: "Yes, I would like to receive email updates about the food bank's work. I understand I can unsubscribe at any time."

The form is tested with a keyboard and a screen reader. The amount buttons are enlarged to meet target size, and the error text is rewritten.

After launch, the team exports consent records monthly and checks that the records include the wording, timestamp and source. At year end, the figures and the fundraising note go into the OSCR return.

Total setup time: two days for the form, one hour for the records process. The cost is staff time, not new software.

Numbered steps for a launch review

Common questions