How Not to Grow Your Email List

A hidden, pre-checked “send me emails” box at checkout is still one of the worst ways to grow a list. It isn’t valid consent under GDPR or Canada’s CASL, and the people it signs up tend to hit “Report spam.” That hurts more today than when this post was written. Since February 2024, Gmail and Yahoo have required bulk senders to keep spam complaints under 0.3%, and Microsoft’s Outlook.com added its own bulk sender rules on May 5, 2025. Put the opt-in box where shoppers can see it, leave it unticked, and let them tick it themselves.

The pre-checked box at checkout

Back-to-school season brings school shopping. For one parent whose kids wear uniforms, it’s a simple job. Shopping online makes it simpler still: a whole year of school clothes, ordered in about eight minutes.

This time she went looking for the same scooters she had bought the year before. (A scooter is a pair of shorts sewn under a skirt, handy for a six-year-old who hasn’t mastered sitting like a lady.) She knew they would last. Even better, they don’t need ironing.

She found exactly what she wanted and placed the order.

On the shipping information page, over on the far right, sat a pre-checked box to receive email updates from the company. She was so busy typing her billing address that everything on the right side of the screen went almost unnoticed.

Hidden pre-checked boxes are not a good or fair way to build a subscriber base. Yet stores keep using them.

The tactic is a magician’s misdirection: look over here, while something you aren’t meant to see happens over there.

Why hidden pre-checked boxes backfire today

The box does add an address to your list. What it doesn’t add is someone who wants your email. That gap now costs you on two fronts: the law in several major markets, and the spam-rate limits set by the biggest mailbox providers.

What the law says about pre-ticked boxes

US law and most other major markets’ laws differ here. If you sell abroad, you need to follow the strictest rules that apply to your customers.

In the United States, CAN-SPAM doesn’t require consent before you send commercial email. It does require an honest sender and subject line, a physical postal address, a clear way to opt out, and opt-outs honored within 10 business days. Fines are steep. The FTC’s January 2025 inflation adjustment set the maximum at $53,088 per violating email, and that figure carries into 2026.

In Europe, the Court of Justice of the EU ruled on 1 October 2019, in the Planet49 case (C-673/17), that a pre-ticked checkbox isn’t valid consent. The court’s reasoning fits the checkout above exactly: if the box is already ticked, there’s no way to show the shopper ever read it or even saw it. The case was about cookies, but it applies the same consent standard that GDPR uses for marketing email.

In Canada, the CRTC’s Compliance and Enforcement Information Bulletin 2012-549 says express consent under CASL needs a positive act. That means a box the user ticks, not one they have to untick. The bulletin also says each consent request needs its own box, so you can’t bundle it with agreeing to the terms of sale.

What mailbox providers measure

Mailbox providers don’t check how you got an address. They watch how recipients react to your mail. Auto-enrolled shoppers who don’t remember signing up are the readers most likely to mark you as spam.

Google also asks senders to process unsubscribe requests within two days. A DMARC record can start at monitoring level, for example:

_dmarc.example.com. TXT "v=DMARC1; p=none; rua=mailto:[email protected]"

Here’s a quick worked example. Say 1,000 checkout customers get auto-enrolled through a hidden box, and 5 of them report your first newsletter as spam. That’s a 0.5% complaint rate, well above the 0.3% ceiling Gmail and Yahoo use. Your engaged subscribers then pay for it too, because a damaged sender reputation pushes mail to the spam folder for the whole list.

Better ways to grow your list at checkout

Checkout is a good place to collect subscribers. Buyers have just shown real interest. The fix is to ask openly, not to give up on asking.

1. Put the opt-in box next to the email field, where shoppers are already looking, not in a side column.
2. Leave it unticked, and label it with what they’ll get and how often, for example “Send me new arrivals and sale alerts, about twice a month.”
3. Keep it apart from the terms-and-conditions box, so agreeing to buy never means agreeing to marketing.
4. Record when and how each person opted in. GDPR and CASL both expect you to be able to prove consent.
5. Send a welcome email right away, and consider double opt-in (a confirmation click) for signups from non-checkout forms.
6. Add one-click unsubscribe headers to every marketing message, and remove anyone who opts out within two days.

There’s an honest counter-argument. An unticked box will sign up fewer buyers than a pre-ticked one, and US law alone doesn’t ban the pre-ticked version. But the extra addresses come with low engagement and more complaints, and complaints are what mailbox providers act on. A smaller list of people who chose to hear from you will deliver better and earn more per send than a bigger list padded with buyers who never noticed the box.

FAQ

Are pre-checked opt-in boxes legal in the US?

Yes, in most cases. CAN-SPAM generally doesn’t require prior consent for commercial email, but it does require, among other things, accurate routing information, non-deceptive subject lines, clear identification of advertising and a working opt-out, with opt-out requests honored within 10 business days. If you have customers in the EU, UK or Canada, though, a pre-checked box won’t count as valid consent for them.

Can I email customers who bought from me without asking?

In the US, generally yes, as long as you follow CAN-SPAM. The UK has a “soft opt-in” for existing customers who bought similar products, but only if you offered a clear chance to opt out when you collected the address and in every message after that. Canada’s CASL allows implied consent for a limited time after a purchase.

What spam complaint rate is too high for Gmail and Yahoo?

Google tells senders to keep their user-reported spam rate below 0.1% and never let it reach 0.3% or higher. Yahoo also uses 0.3% as its limit. You can track your Gmail rate in Google Postmaster Tools.

Does double opt-in hurt list growth?

It lowers the raw signup count, because some people never click the confirmation link. In return, you get valid, typo-free addresses and a record of consent. It also helps keep spam traps and fake signups off your list, which matters a lot for forms that bots can reach.

Do Gmail’s bulk sender rules apply to small senders?

The strictest rules apply once you send about 5,000 messages a day to personal Gmail accounts. All senders still need SPF or DKIM and a low spam rate. Messages from a domain count toward the threshold even when they go out through an email service provider.

Sources

• Google Workspace Admin Help: Email sender guidelines
• Google Workspace Admin Help: Email sender guidelines FAQ
• Yahoo Sender Hub: Best practices
• Microsoft Tech Community: Outlook’s new requirements for high-volume senders
• FTC: CAN-SPAM Act, A Compliance Guide for Business
• Federal Register: FTC Adjustments to Civil Penalty Amounts (January 2025)
• Court of Justice of the EU: Press release 125/19, Planet49
• CRTC: Compliance and Enforcement Information Bulletin 2012-549