3

As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-default-clicked opt-in checkboxes to something where the user actually has to physically click the box to receive any e-mails. This led me to believe the previous practice was outlawed by GDPR.

But was it? I still sometimes rarely find a form that requires user action to unclick newsletter during registration and I wonder if what their doing is illegal, they are just being sneaky about it.

2

Under GDPR Article 4:

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her

Under Recital 32:

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent.

Thus any forms using the older opt-out method do not seem to be establishing consent for processing in a manner compliant with the GDPR. I suppose that if the subject has previously given consent in some other explicit way, an opt-out checkbox could be a method of withdrawing consent. But I suspect that such sites have simply failed to make needed changes. Or perhaps those running such sites believe that their processing would be lawful on some basis other than consent.

  • 1
    Thanks for the references! I'm a bit suspicious about the last sentence of your reply being true. Specifically, this is booking with Ryanair, which requires you to log in but then, whatever your current marketing newsletter setting is, there is an opt-out box at every new booking. I will try to contact them about this but they are known for ignoring anything that isn't a lawsuit. – Petr Doležal Feb 26 at 0:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.