No, you don't need a consent form. The GDPR does not require consent.

For example, you don't need consent to store server logs with IP addresses if all they're used is for security and auditing. You don't need consent to archive receipts and invoices if you need to do that for tax purposes, even though those are full of PII. You don't always have to let people opt out of that, either!

That's called legitimate interest, and did you know you have it?

If the person might be a child then the rules have been complex and obtuse since forever. You might need a DPO for regulatory compliance, much in the same way you might need an accountant.