

A required consent box above the pay button on the Checkout block.
Extra tick boxes at checkout: your terms, an age confirmation, a marketing
opt-in. Up to five, each with its own wording and its own refusal message.
The point of the box is being able to show, months later, that this customer
ticked it. Every “just add a checkbox” snippet validates the tick and throws
it away, which leaves a shop with a checkout that looks compliant and an
order file that proves nothing. Here the acceptance lands on the order, and
every order screen carries a Consent panel showing it.
Rewrite your terms next month and a past order still says what was actually
agreed to, because the wording as it was shown is written onto the order
beside the tick — not a reference to a setting that has since moved on. The
time is recorded too, because “when” is half of what a consent record is
for.
The required attribute is a courtesy to the browser and nothing more —
anybody can post past it. A required box that was not ticked stops the order
on the server, where the order is actually created.