What is pre-checked box compliance status under GDPR?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Imagine you're building a signup form and you think: "I'll just pre-check the newsletter box. Anyone who doesn't want it can uncheck it." Under GDPR, that reasoning fails the legal test entirely.
GDPR Article 7 and Recital 32 require that consent be given through a "clear affirmative act." Silence, pre-ticked boxes, and inactivity don't count. The Court of Justice of the EU confirmed this in the Planet49 ruling (2019), making it clear that a pre-checked box can't establish valid consent for marketing communications.
The problem isn't just legal: pre-checked boxes make it impossible to know who actually wanted to subscribe vs. who simply missed the checkbox. GDPR's consent framework is built on deliberate choice. Pre-checked boxes flip that on its head by making opt-in the default rather than the decision.
If you've already collected subscribers through pre-checked boxes, that consent is almost certainly invalid under GDPR. You'd need to run a consent refresh campaign before continuing to email those contacts. Many ESPs now flag or block pre-checked mechanisms outright.
These aren't a gray area. They're a clear violation. If you're unsure whether your signup forms are compliant, we're happy to take a look at reviewmyemails.com/sos.
The most useful email questions, once a month
One email a month. New questions worth reading, real deliverability changes (Gmail and Outlook updates, etc.), and any tool or report that landed since the last issue. No fluff, no upsell.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
