What is a consent checkbox?

What makes a tick count

Four things turn a ticked box into consent you can rely on. The person was told what they are agreeing to, in words specific enough to picture: which messages, from whom, roughly how often. The box covers one purpose, so agreeing to a newsletter does not also mean agreeing to have details passed to a sponsor. The choice was free, so saying no does not stop them getting what they came for. And the person did something, ticking the box themselves, rather than failing to untick a box somebody else ticked. Australia's privacy regulator describes consent in similar terms: adequately informed, voluntary, current and specific, and given by someone with capacity. A box that meets all four tests is short, specific and a little boring, which is the point: nobody should be surprised later by what they signed up for.

Why the box starts empty

A pre ticked box records the form designer's preference, not the respondent's. The EU regulation defines consent as a statement or a clear affirmative action, and its Recital 32 says plainly that silence, pre ticked boxes or inactivity should not constitute consent. The Court of Justice applied the same idea in Planet49, holding that a pre checked box the user had to deselect did not give valid consent to cookies. There is a practical reason too. Lists built from pre ticked boxes fill with people who never meant to join, and they unsubscribe, ignore or report the messages, which costs more than the smaller honest list would have.

The rules by jurisdiction

In Australia, the Spam Act requires consent before sending marketing messages. The regulator's guidance says express consent can be given by filling in a form or ticking a box on a website, that a record should be kept of who consented, when and how, and that the sender must prove consent. Every message must identify the sender and carry an unsubscribe that works for at least 30 days and is honoured within 5 working days. In the European Union, consent must be demonstrable, as easy to withdraw as to give, and not made a condition of a service that does not need it. In the United States, CAN-SPAM does not require consent before commercial email, but each message needs a working opt out and requests must be honoured within 10 business days. None of this is legal advice for a particular list.

Common mistakes

Making the marketing box required, which turns consent into the price of a quote or a download. Bundling it with the terms and conditions, so one tick means two different agreements. Vague wording such as updates from carefully selected partners, which does not tell anybody what they agreed to. Emailing people to ask for consent, which the Australian guidance says is itself a marketing message. And changing the wording without keeping the old version, which leaves you unable to show what earlier subscribers actually saw. Finally, collecting signups at a market stall or a counter and typing them in later without noting when and how each person agreed, which is exactly the record the Australian guidance asks senders to keep.

Building one in this form builder

A consent box is a checkboxes field with a single option worded as the agreement. Options start unselected and there is no default value setting, so the box cannot be shipped pre ticked. Leave a marketing box optional. A required checkboxes field only needs one ticked option, so a statement that must be accepted, such as terms of entry, belongs in its own required field rather than sharing a field with the marketing line. On a classic form a field description is not shown to the respondent, so put the explanation in the option wording or a paragraph above. The export writes the option label, not an internal value, and each response keeps its submission time and the form version it was submitted against.

Questions people ask