Tattoo consent forms — what has to be in one for it to count

Most studios have a consent form. Fewer have one that survives contact with an unhappy client. The difference is not length — it is whether the paper shows that the client understood what they were agreeing to.

Age is not negotiable in the UK

Start here, because it is the one rule with criminal consequences. Under the Tattooing of Minors Act 1969 it is an offence to tattoo anyone under 18 in England, Wales and Scotland. There is no parental consent exception. A parent signing your form changes nothing.

The only defence is showing you had reasonable cause to believe the person was 18 or over — which in practice means you checked photographic ID and recorded that you did. "They looked old enough" is not a defence.

Piercing is different and messier. Scotland regulates it under the Civic Government (Scotland) Act 1982; in Wales the Public Health (Wales) Act 2017 bans intimate piercing under 18. Most studios apply an 18 rule across the board rather than track four sets of rules.

Your premises licence is part of the paperwork

In England and Wales, tattooing and piercing premises are registered with the local authority under the Local Government (Miscellaneous Provisions) Act 1982, and the byelaws that come with registration set your hygiene obligations. Scotland licenses under its own regime.

Worth naming in the consent form: it tells the client the studio is regulated, and it tells an environmental health officer that you know it.

Four things a weak form is missing

A health questionnaire that asks real questions. Anticoagulants, diabetes, skin conditions at the site, pregnancy, keloid tendency, allergies to latex or dyes. This is your only chance to learn something that changes the decision.

Risks named in plain words. Redness, swelling, weeping, pigment loss, uneven uptake, the likelihood of a touch-up, scarring, allergic reaction. A client who signed a list of risks cannot later say nobody mentioned them.

Aftercare handed over and acknowledged. Aftercare shifts part of the responsibility for the result onto the client — but only if you can show they received it.

Identity, not just a name. Record that ID was produced. On an under-18 challenge this is the entire case.

What must not be in it

A blanket exclusion of liability for personal injury. Under the Consumer Rights Act 2015 you cannot exclude liability for death or personal injury caused by negligence, and unfair terms in a consumer contract are not binding. A clause saying "the studio accepts no responsibility for any complications" does nothing except signal that whoever wrote the form did not know the law.

Everything bundled into one tick. Consent to the procedure, consent to processing health data, and consent to publish photographs are three separate decisions. Marketing consent has to be freely given, which means refusing it cannot block the appointment.

UK GDPR: health answers are special category data

The health questionnaire is special category data under Article 9 UK GDPR. Processing it is prohibited unless a condition applies — for a tattoo studio that is normally the client's explicit consent under Article 9(2)(a), with a corresponding condition in Schedule 1 of the Data Protection Act 2018.

The practical consequence: two separate signatures, not one. And a retention period you can justify — the Limitation Act 1980 gives six years for contract claims and three for personal injury from the date of knowledge, so six years is a defensible floor.

Your supervisory authority is the Information Commissioner's Office.

Paper against a tablet

A sheet in a folder fades, goes missing, and cannot be found in fifteen seconds while the client is standing in front of you. A form signed on a tablet fixes all three — provided the system records when the document was created and can show the content has not changed since.

That last point matters more than it sounds. A PDF with no integrity protection is worth exactly what a photocopy is worth: whatever the other side is willing to concede.