Is it illegal to pre-check the email opt-in option for an html form?

Question

Email opt-in and opt-out for online registration forms is subject to GDPR compliance rules.

However, I don't see any information out there about whether it is ok for an email opt-in checkbox to be pre-ticked, before a user chooses whether to opt in or out of a mailing list. A pre-checked checkbox would require a user to uncheck it, if they wish to be opted-out for emails.

My Question:

Is it illegal to pre-check the email opt-in checkbox in a registration form, forcing the user to uncheck the box if they choose not to receive emails?

Answer 1

If you are relying on consent as the legal basis for this processing of personal data, then it MUST be opt-in. Pre-ticked checkboxes are not compliant.

If you are relying on a legitimate interest though, then an opt-out solution is OK. What falls under a legitimate interest can be fairly flexible, but you are required to show that this legitimate interest outweighs the “rights and freedoms” of the recipient.

It is not clear from your description which legal basis would be appropriate. This would depend on the contents of the emails. E.g. updates for new blog posts might be fine under a legitimate interest, but using the mailing list to disseminate marketing from third parties would likely require consent.

The ePrivacy directive has more specific rules on unsolicited communications, and allows you to send marketing emails about similar products or services to your own paying customers, if they can opt-out in the form where the email address was collected, e.g. by unticking a box, and if you include an unsubscribe link in every message:

Art 13(2): […] where a natural or legal person obtains from its customers their electronic contact details for electronic mail, in the context of the sale of a product or a service, in accordance with [the GDPR], the same natural or legal person may use these electronic contact details for direct marketing of its own similar products or services provided that customers clearly and distinctly are given the opportunity to object, free of charge and in an easy manner, to such use of electronic contact details at the time of their collection and on the occasion of each message in case the customer has not initially refused such use.

National laws might provide further details for this or other processing situations.

Answer 2

Article 4(11) says:

‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;

Recital 32 says (my emphasis):

Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement.² This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data.³ Silence, pre-ticked boxes or inactivity should not therefore constitute consent. ...

At the time of writing, the most recent guidance on consent from the European Data Board says:

The use of pre-ticked opt-in boxes is invalid under the GDPR