Most jurisdictions explicitly restrict pre-ticked consent
Aliases: opt-in requirement · consent law · GDPR consent
What it is
Pre-ticked consent is explicitly restricted or banned across most jurisdictions: the EU's GDPR and its case law (a pre-ticked box does not constitute valid consent), California's consumer-privacy opt-out requirements, and multiple consumer-protection frameworks. This entry covers the shared logic of those rules — "consent requires an affirmative act" — and the compliant product forms; a design and engineering reference, not legal advice.
Why it happens
The shared logic defines consent as an explicit, affirmative act: legally, a pre-ticked box equals "no consent given," not "consent given" — the landmark court ruling on cookie consent established that pre-ticked checkboxes carry no valid consent. The deeper rationale matches the behavioural research: inaction is an ambiguous signal that cannot distinguish "genuinely agrees" from "didn't notice," and law needs attributable acts. The product-form corollaries are direct: consent-class options ship blank; marketing email requires affirmative opt-in; cookie-consent interfaces may not pre-tick "accept." The compliance check operationalizes to one sentence: find every consent point where "no action by the user takes effect," and confirm the legality of each in its applicable jurisdiction.
Where it stops holding
Jurisdictions diverge: the EU requires opt-in while parts of the US allow opt-out (marketing email may default-subscribe under anti-spam law provided unsubscribe is prominent) — cross-market products unify to the strictest standard. "Legally arguable but directionally suspect" forms exist: burying consent in terms ("continued use constitutes agreement") stands in some jurisdictions yet is preselection by another name, and should not be adopted merely because it is unprosecuted. The rules evolve quickly; the state described here reflects writing time and must be re-checked against current case law before use.
Applying it
- Build a consent-point register: list every consent collection point in the product, tagging collection form (opt-in / opt-out / preselected), applicable jurisdictions, and legal conclusion — maintained as rules change.
- One default form worldwide: consent-class options are uniformly "blank by default plus affirmative tick," set to the strictest standard, avoiding per-market switches' maintenance cost and omission risk.
- Verification: a semi-annual consent-point audit re-checking the register against the latest rulings and guidance; findings and remediations stay on file as the evidence chain of good-faith compliance.