Testimonial Release Forms: What You Actually Need Signed

Six fields and a signature. That is the whole document: who is publishing, what content, on which channels, whether the customer gets tagged, that they can change their mind, and their name and signature with the date. It fits on a phone screen and it takes about four seconds to complete.

What you do not need is the three-page release a stock photo agency uses. Long forms are not safer. They are longer, which means the customer does not read them, and consent that was not read is the weakest kind you can hold — you end up with an impressive-looking document and a customer who genuinely did not understand what they agreed to.

The six fields

1. Who is publishing. Your business, by its actual name. “I authorise Garage Belotti to publish…”. Not “we”, not a brand the customer has never seen written down.

2. What content. This recording, made today. Specific to the thing in front of you — not “any content featuring the customer”, which is a blank cheque and will be treated as one.

3. Which channels. Name them. Facebook, Instagram, TikTok, and whatever else you genuinely publish to. A customer who agreed to Facebook has not agreed to TikTok, and the gap between those two is where complaints are born.

4. Tagging — separately, and optionally. Their Instagram handle, their TikTok, their Facebook. Each optional. Being tagged sends a notification to everybody they know, which is a public act with real consequences for them, and it deserves its own decision rather than being bundled into the first yes.

5. That they can withdraw. One line saying they can ask you to take it down, and how. This is not a courtesy — under GDPR Article 7 withdrawal must be as easy as giving consent was, so the route out has to exist and has to be findable.

6. Name, signature, date. The part that turns “they said yes” into something you can actually show. Article 7 puts the burden on you: the controller “shall be able to demonstrate that the data subject has consented.”

Six fields. That is a release.

What to leave out, and why

The instinct, once you start writing a legal-looking document, is to add protection. Almost every addition makes the form worse.

Perpetual, worldwide, irrevocable rights in all media now known or hereafter devised. This is agency boilerplate for commercial models who are being paid to sign it. On a phone in a garage, it does two things: it frightens the customer, and it collides head-on with a right to withdraw that you cannot contract away anyway. It is not protection. It is a reason for someone to say no.

A waiver of every conceivable claim. A customer who has just had their brakes done is not in a position to give informed consideration to a liability waiver, and a court will notice that. Meanwhile the customer notices only that a friendly interaction has turned into paperwork.

A blanket permission for future recordings. Tempting, because signing once is easier than signing every time. But consent has to be specific to be consent. “Anything we film of you from now on” is not specific, and it will not survive contact with anybody who examines it. Sign one per recording; it takes seconds, and it is the cheapest part of the whole process.

Anything the customer would need to read twice. If the form is long enough that they skim it, you have converted real understanding into a signature on a document — which is the wrong trade, in exactly the wrong direction.

What it looks like in a garage

A repair shop. The customer has come to collect the car, the noise is gone, and they are visibly relieved because they had assumed it would cost twice as much.

The mechanic asks. The customer records thirty seconds standing next to the car, saying what was wrong and how it went, in their own words, with the “ehm” left in. Then the mechanic hands over the phone, and on the screen is a short block of text: Garage Belotti may publish this video, on Facebook, Instagram and TikTok, and — if the customer fills them in — tag @handles. They can ask for it to be removed at any time. Sign here.

Finger on the glass. Done.

The whole thing looks like signing for a parcel, and that resemblance is doing real work: it is a familiar gesture that carries no fear. It is the same object as a three-page release, minus everything that was making it unusable, and it produces the one thing that actually matters — a customer who understood, and evidence that they did.

That is how ciaopost handles it, and the reason we built the signature in rather than a checkbox is precisely this: a checkbox is clicked, a signature is performed, and the two seconds of attention it costs are the two seconds in which the customer actually reads the sentence.

Keep the copy, and know where you posted

A signed release you cannot find is a release you do not have.

Two things need to survive the day: the consent itself, and a record of where the content went. The first is the document. The second is the part everybody forgets, and it is the one that gets tested — because the phone call you eventually receive is not “did I consent?”, it is “please take it down.”

If a customer asks tomorrow, you should be able to answer, in a minute: this is what she signed, and her video is on these three channels. Not “it’s somewhere on the Facebook, I’ll have a look this weekend.”

Then don’t touch what they said

The release is permission to publish. It is not permission to edit.

The words go out exactly as the customer spoke them — the pause, the false start, the sentence they abandoned halfway. Not tidied, not shortened, not improved, and not in the subtitles either. A signature at the bottom of a form does not turn their opinion into your copy.

This is not caution. It is the only reason the recording is worth anything. A testimonial that reads better than the customer speaks is a fake one, and a stranger scrolling past can hear the difference immediately.

Six fields, four seconds, on the phone in your hand

You do not need a lawyer to start collecting testimonials properly. You need six fields, a signature, a copy you can produce, and a note of where you published.

If you are collecting on paper, print it on a card and keep the cards. If you are collecting on a phone, the form should be on the same screen as the recording, in the same minute, before anything goes out — because the release you go back and chase afterwards is the release you never get.

The full picture of what consent has to cover, and where the law actually sits, is the next thing worth reading.