Consent Setup for Personal Data Processing in 1C-Bitrix

Consent Setup for Personal Data Processing in 1C-Bitrix

A consent form for personal data processing is not just a checkbox. We've encountered projects where the lack of proper consent led to site blocking by Roskomnadzor. Fines under Article 13.11 of the Administrative Code reach $680–980 for officials and up to 300,000 for legal entities. Consent must be documented, tied to a specific user and form, and be revocable while preserving history. Bitrix provides the UserConsent module for this, introduced in the D7 core. With over 7 years of experience implementing 1C-Bitrix and 50+ full-cycle projects, we guarantee compliance with 152-FZ and 54-FZ. Even a single feedback form without consent can trigger an unscheduled inspection. A detailed audit of all data collection points is the first step toward compliance.

How the Built-in UserConsent Mechanism Works

Since D7 core, Bitrix includes the \Bitrix\Main\UserConsent\Consent class and related tables. The main ones:

• b_user_consent — records of user consents
• b_user_consent_text — consent texts with versioning

Consent is created via the add() or addByContext() method:

$result = \Bitrix\Main\UserConsent\Consent::addByContext( 'feedback_form', // Context ID (form name) [ 'USER_ID' => $userId, // or 0 for anonymous 'USER_IP' => $_SERVER['REMOTE_ADDR'], ], [ 'AGREEMENT_ID' => 1, // ID of the agreement text from b_user_consent_text 'URL' => \Bitrix\Main\Application::getInstance()->getContext()->getRequest()->getRequestUri(), ] ); 

The AGREEMENT_ID field points to a specific version of the consent text. This is important: if you update your privacy policy, old consents remain linked to the old version — proving exactly what text the user agreed to.

Configuring Consent Texts via Admin Panel

Consent texts are managed in /bitrix/admin/ through the main module. Each text has an ID, title, and versioned content. When updating the privacy policy, a new version is created — old consents remain valid, and new users see the latest text.

For each form on the site, a separate 'context' (string identifier) is created: registration, checkout, callback_form, newsletter. This allows tracking which entry point collected the consent.

Integration with Forms and Web Forms

Registration form. The bitrix:main.register component supports a built-in consent checkbox — set USE_AGREEMENT = Y in component parameters, and pass the agreement text ID via AGREEMENT_ID. Data is recorded automatically on successful registration.

Web Forms module (form). For feedback forms, add a field of type AGREEMENT in the form builder (/bitrix/admin/form_edit.php). On submission, Bitrix automatically records the consent in b_user_consent linked to the form result (b_form_result).

Custom forms. For manual POST handling (e.g., AJAX form with Fetch API), call Consent::add() in your PHP handler before saving form data. Without this, consent is never recorded, even if the checkbox appears on the page.

Handling Consent Revocation

Users must be able to revoke consent. In the personal account (/personal/), add a consent management page. List a user's consents:

$consents = \Bitrix\Main\UserConsent\ConsentTable::getList([ 'filter' => ['USER_ID' => $USER->GetID()], 'order' => ['DATE_CREATE' => 'DESC'] ]); 

Revocation is not deletion; it creates a new record with IS_ACCEPTED = N. The history is preserved: the user gave consent, later revoked — dates are recorded. This is legally critical.

After revocation, you must decide what to do with already collected data. There is no automatic deletion — it's an organizational process requiring technical support.

Why the Built-in UserConsent Module Beats Custom Implementation

Custom solutions often ignore text versioning and context binding. UserConsent ensures legal compliance three times faster to implement and eliminates the risk of site blocking. Moreover, the module automatically logs IP, URL, and user ID — satisfying regulatory requirements. On a recent e-commerce project with 15 forms, we implemented UserConsent in 3 days, reducing compliance risk to zero.

How to Check Consent Before Processing Data

At critical points (before sending email newsletters, before transferring data to CRM), check for active consent:

$hasConsent = \Bitrix\Main\UserConsent\Consent::isAccepted( 'newsletter', ['USER_ID' => $userId] ); if (!$hasConsent) { // do not process data } 

This prevents situations where a user revoked consent but the system continues sending emails due to accumulated queues in the b_subscribe_subscription table.

Stages of Turnkey Consent Configuration

Cost is calculated individually after analyzing the scope of forms and modifications. Contact us for a free project estimate. We work with a 12-month warranty and 1C-Bitrix certificates.

Comparison: Custom Implementation vs UserConsent

Our Process: Step by Step

1. Audit all data collection points on the site (forms, cart, personal account).
2. Create contexts for each form in the UserConsent module.
3. Connect consent to existing components via parameters or rewrite.
4. Set up a consent revocation page and handling logic for withdrawal.
5. Test scenarios: registration, form submission, revocation, consent check.

Ensure your site is protected from fines. Get a consultation right now — contact us for a project cost estimate.