Enabling Web Form Verification Settings

You can enable verification settings for web forms so data subjects can authenticate their email addresses and existing accounts when accessing web forms, as well as verify the identity of data subjects during request intake.

To enable verification for web forms

  1. On the Privacy Rights Automation menu, select Setup > Web forms. The Web form templates screen appears.

  2. Hover over the desired web form tile to reveal and click the View button. The Web form customization screen appears.

  3. Navigate to the Verification tab and enable your desired settings. For more information, see Verification Settings Screen Reference.
  4. Click the Save to save your verification settings.

To resend email confirmation alerts

With a OneTrust 6.21 preview feature, you can resend email confirmation notifications to data subjects whose email address has yet to be verified. This option is only for requests that are held in the UNVERIFIED workflow stage.

  1. On the Privacy Rights Automation menu, select Requests. The Requests screen appears.

  2. Click a Request ID to open the Request details screen.
  3. Click the Context Menu icon in the header. The Context menu appears.

  4. Select Resend email confirmation verification. The Resend verification email modal appears.


  5. Click the Send button to confirm your choice. OneTrust will resend the email confirmation to the data subject's submitted email address.

Verification Settings Screen Reference

Authentication Methods



Field
Description
Enable authentication on web form

Select to configure authentication through an Open ID Connect (OIDC) provider. This will require users to authenticate with an existing account when accessing the web form.

For more information about configuring single sign-on authentication, see Configuring OIDC Implicit Grant Type Authentication for Web Forms.

Allow access to web form without authentication

Select to give users the option of logging in with an existing account to access the form or proceed without logging in.

Identity provider configuration

Select or create a new Identity Provider and provide a base URL for this configuration. Validate the base URL to proceed.

For more information, see ID Verification & Authentication Methods.

Verification Methods



Field
Description
Enable email verification

Enable to require data subjects to double opt-in and verify their email address. These requests will appear in the Request Queue on the Requests screen as Unverified.

Set requests to expire

Enable to automatically expire unverified requests after a specified number of days.

Days allowed to verify request

Enter the number of days a data subject has to verify the request before it expires.

Resend verification email

Enable to allow the re-sending of the email that will remind data subjects to verify their email address for unverified requests before they expire.

Days before verification reminder

Enter the number of days after which a data subject will be reminded to verify their email address.

Enable Third-Party ID Verification

Select to enable verification of a user's identity with an external Identity Provider. You will need to provide your third-party verification provider's account details to OneTrust in order to set up the configuration.

For more information about configuring ID verification and OneTrust's supported practices, see the OneTrust ID Verification Framework Guide.

Select verification credentials

Once your account has been seeded with your third-party verification account details, you can select that provider here or add a new configuration.

Enable phone number verification

Enable to allow data subjects to verify their phone number.

Verification Conditions

You can configure verification conditions to define criteria that determine which verification methods are applied to a request.

Note:

You must enable more than one verification method to configure verification conditions.



Field
Description
Skip Verification for Auto-Rejected Requests

Enable to skip for any requests which are set to be automatically rejected based on automation rules in the rules tab. Email verification is always skipped for auto-rejected requests, regardless of this setting.

Verification conditions

Click the Add rule button to configure a new conditional rule.

Default verification method

This field will only display once a rule is added.

Select a default verification method from the selection menu.

Rule name

Enter a name for the rule.

Field

Select a field. The following fields are available as conditions:

  • Subject type

  • Request type

  • Country

  • State

Operator

Select an operator for the rule.

Value

Select a value that corresponds to your selected field.

Note:

Conditions with multiple values selected in this field will trigger when any one of the values meets the condition.

Verification Conditions: Things to Know

  • All three verification methods (email, third party ID, and phone number) can be enabled at the same time, but cannot all be used on the same rule. If all three verification methods are enabled, a rule must be configured.

  • Rules can be added if at least one verification method is enabled.

  • Rules will not be processed for requests created via API. Only the default verification will be applied.

  • Opt-out requests submitted using the web form are determined to have been submitted after a user clicks the Submit button.

  • For opt-out requests, steps taken by users in the web form, including filling out required fields, completing reCAPTCHA, and clicking the Submit button are valid steps to verify the identity of a person, and do not constitute a 'verifiable consumer request.' Setting up further verification methods, such as email confirmation, would constitute two-factor authentication and may be considered unlawful in certain jurisdictions.