Is it legal to have a opt-out of marketing emails checkbox under GDPR?
<p>As soon as GDPR came into effect I noticed all of the registration forms suddenly changed all of their e-mail marketing checkboxes (all of the "Send Newsletters", etc.) from the previous opt-out or by-default-clicked opt-in checkboxes to something where the user actually has to physically click the box to receive any e-mails. This led me to believe the previous practice was outlawed by GDPR. </p>

<p>But was it? I still sometimes rarely find a form that requires user action to unclick newsletter during registration and I wonder if what their doing is illegal, they are just being sneaky about it.</p>

<p>Under <a href="https://gdpr-info.eu/art-4-gdpr/" rel="nofollow noreferrer">GDPR Article 4</a>:</p>

<blockquote>
  <p>‘consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her</p>
</blockquote>

<p>Under <a href="https://gdpr-info.eu/recitals/no-32/" rel="nofollow noreferrer">Recital 32</a>:</p>

<blockquote>
  <p>Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. </p>
</blockquote>

<p>Thus any forms using the older opt-out method do not seem to be establishing consent for processing in a manner compliant with the GDPR. I suppose that if the subject has previously given consent in some other explicit way, an opt-out checkbox could be a method of <strong>withdrawing</strong> consent. But I suspect that such sites have simply failed to make needed changes. Or perhaps those running such sites believe that their processing would be lawful on some basis other than consent.</p>

gdpr consent