Tattoo consent forms: age checks, licensing and health data

A consent form is where three separate duties meet: the law on tattooing under-18s, your council's registration or licence rules, and data protection for the health answers your clients give you. This guide takes each in turn. It covers England. Scotland, Wales and Northern Ireland have their own arrangements, which we have not covered here, so check with your council if you work there.

Age: no tattoos under 18

Section 1 of the Tattooing of Minors Act 1969 says "It shall be an offence to tattoo a person under the age of eighteen". The only exception is a tattoo done for medical reasons by a qualified medical practitioner or someone working under their direction. The Act makes no exception for parental consent.

The Act gives a defence if, at the time, you "had reasonable cause to believe" the client was 18 or over and did in fact believe it. A box ticked on a form is weak evidence of reasonable cause if the client plainly looked young. Asking for photo ID whenever there is any doubt, and noting on the form that you checked it, is the practical way to be able to show you had good reason.

Check the age against the day of the tattoo, not the day the form is filled in. A client who books in March for a session in October needs to be 18 by October.

Registration and licensing

Outside London, tattooing is covered by Part VIII of the Local Government (Miscellaneous Provisions) Act 1982, but only in areas where the council has resolved to adopt it. Where it applies, a person may not carry on tattooing "unless he is registered by the local authority for the area", and the premises are registered too. Councils can make byelaws covering hygiene, including "the cleansing and, so far as is appropriate, the sterilisation of instruments". Working without registration is an offence with a fine of up to level 3 on the standard scale, and a registered person must keep their certificate and a copy of the byelaws "prominently displayed" where they work.

In London, boroughs that have adopted Part II of the London Local Authorities Act 1991 license premises as "special treatment" establishments, and tattooing is on the list. No premises in the borough may be used for special treatment without a licence, and the offence carries a fine of up to level 4. Each borough sets its own conditions. For example, Wandsworth says the licence holder must make sure everyone giving treatments is suitably qualified or trained.

If you guest in another area, the rules there apply, and under the 1982 Act registration is by the council "for the area". Ask that council before you travel, not when you arrive.

What to record

We found no national rule that sets out what a tattoo consent form must contain. Your council's byelaws or licence conditions may set requirements, so read those first. Beyond that, most artists record:

• The client's full name and date of birth, and whether you checked ID.
• Health questions that affect whether it is safe to tattoo today: pregnancy, conditions such as diabetes or epilepsy, blood thinners, allergies, skin conditions on the area, and alcohol or drugs in the last day.
• The design, placement and date of the session.
• That the client has had the aftercare advice.
• The client's signature and the date they signed.

Ask only what you will use. Every extra question is more health data to look after.

Health answers are special category data

The ICO lists "data concerning health" as special category data under UK GDPR. To use it, you need two things, chosen separately: a lawful basis under Article 6, and a condition under Article 9. The ICO's rules on special category data say you "must always identify an article 6 lawful basis". Explicit consent is one Article 9 condition, at 9(2)(a), and needs no extra condition from Schedule 1 of the Data Protection Act 2018, though the ICO notes explicit consent is not always appropriate. Which basis and condition fit your studio is a decision to make deliberately and write down.

How long to keep forms

The ICO's guidance on storage limitation says "The UK GDPR does not set specific time limits for different types of data". How long you keep forms depends on why you need them, and you "should not keep data indefinitely 'just in case'". We found no fixed period for tattoo consent forms. If your insurer or council sets one, follow it and write it into a short retention policy. Otherwise pick a period you can explain, and delete forms once it has passed.

How consent works on TattooInn

Clients confirm they are 18 or over before they can send a request. Before the session they sign a consent form in the app: full name, date of birth, six health questions with room for allergy notes, a finger signature, and a confirmation that they are 18 or over and have read the aftercare notes. The date of birth is checked against the session date, and the form will not accept anyone who would be under 18 on the day. It does not check ID, so you still need to do that in person when in doubt.

More on TattooInn for artists, our guide to tattoo deposits, or how booking apps compare.