Leave every marketing consent box unchecked, and word it so that ticking it means “yes, send me email.” A reversed box, where ticking means “no thanks,” is still legal for US commercial email under CAN-SPAM. But it does not count as consent under the EU GDPR, Canada’s CASL or the UK’s PECR, and it fills your list with people who never knowingly signed up. What has changed since this post first ran: Gmail and Yahoo began enforcing bulk sender rules in February 2024 (SPF, DKIM, DMARC, one-click unsubscribe and a spam complaint rate below 0.3%), and Microsoft’s Outlook.com followed on May 5, 2025. Subscribers who never meant to join now cost you inbox placement as well as goodwill.
It is a well-known best practice to leave the opt-in box unchecked when you add an email sign-up to an unrelated form that also collects email addresses, such as a sweepstakes entry.
A message from Benjamin Moore Paints promoted a $10,000 room makeover sweepstakes run with Pottery Barn. The sweepstakes page asked for the usual details: full name, address and email address. Below those fields sat two unchecked checkboxes.
Most people would read these as standard opt-in checkboxes, the kind you tick if you want to receive information from Pottery Barn and Benjamin Moore.
That was not how they worked.
Ticking the boxes meant declining future emails.
Flipping the question people have come to expect, so that you check to opt out instead of checking to opt in, can grow a database. But an unchecked box is not automatically a best practice. What matters is what the box asks. A reversed box counts on people skimming the form, and people who skim it end up on a list they did not choose.
Why the reverse checkbox fails today
A reversed checkbox gets around the “never pre-check” rule on paper, but it fails the test that regulators and mailbox providers actually use: did the person take a clear action that meant yes? Here is how the main rules treat it as of November 2026.
| Rule or provider | What it requires | Does a reverse “check to opt out” box qualify? |
|---|---|---|
| CAN-SPAM Act (US, enforced by the FTC) | No prior consent for commercial email, but a working opt-out honored within 10 business days, plus accurate headers and a postal address | Legal, but you must still honor every opt-out. Penalties run up to $53,088 per violating email (the 2025 level, which the FTC kept for 2026) |
| GDPR (EU) | Consent must be a clear affirmative act; Recital 32 rules out “silence, pre-ticked boxes or inactivity” | No. Not ticking a box is inactivity |
| CJEU Planet49 ruling (C-673/17, 1 October 2019) | Consent needs active behavior by the user | No. The court rejected a box the user had to untick to refuse |
| CASL (Canada, enforced by the CRTC) | Express consent needs a positive or explicit indication; CRTC Bulletin 2012-549 says opt-out mechanisms are not acceptable | No. The sender also has to prove consent was given |
| Gmail and Yahoo bulk sender rules (from February 2024) | SPF, DKIM and DMARC, one-click unsubscribe on marketing mail (honored within two days), spam rate below 0.3% | No legal test, but confused subscribers report spam, and that pushes your rate toward the 0.3% limit |
| Outlook.com high-volume sender rules (from May 5, 2025) | SPF, DKIM and DMARC for domains sending over 5,000 messages a day to Outlook.com addresses | Same risk: authentication gets you in the door, complaints keep you out |
The strongest argument for the reverse box is the one the original post admitted: it grows the list. In the US the CAN-SPAM opt-out model allows it, and some of those passive sign-ups will open and buy. The counter-argument is stronger in 2026. Google wants senders to stay below 0.1% spam complaints and never reach 0.3%, and a list full of sweepstakes entrants who did not know they joined is exactly where complaints come from. One bad promotional send can push your sending domain into the spam folder for the people who did ask for your email.
A clean version of the Benjamin Moore and Pottery Barn form would look like this:
- Keep the sweepstakes entry fields separate from any marketing choice.
- Add one unchecked box per brand, worded positively: “Yes, email me design ideas and offers from [brand].”
- Make entry valid whether or not either box is ticked, so consent is not bundled with the prize.
- Store the date, time, form and wording for each consent, which CASL and GDPR both expect you to be able to prove.
- Send a welcome or confirmation email straight away, so new subscribers recognize you before the first promotion.
FAQ
Are pre-checked opt-in boxes illegal in the US?
Not for email. CAN-SPAM is an opt-out law, so you can send commercial email without prior consent as long as you identify the message as an ad where required, include a valid postal address and honor opt-outs within 10 business days. The FTC’s 2022 staff report on dark patterns does treat misleading consent designs as a consumer protection concern, so a confusing form is still a risk.
Is a “check this box to opt out” design valid consent under GDPR?
No. GDPR consent needs a clear affirmative action, and Recital 32 says silence, pre-ticked boxes and inactivity do not count. Leaving a reverse box unticked is inactivity, so it cannot be your lawful basis for marketing email to people in the EU.
Can you require marketing consent to enter a sweepstakes?
In the US, many brands make an email sign-up part of sweepstakes entry, but you need to say so clearly in the official rules and on the form. Under GDPR, consent tied to entry when it is not needed for the prize is unlikely to count as freely given. Separate, optional boxes are the safer design everywhere.
How do confusing checkboxes affect deliverability?
People who do not remember signing up mark your mail as spam. Gmail and Yahoo require bulk senders to keep the spam rate below 0.3%, and Google recommends staying under 0.1%. A few thousand reluctant sweepstakes subscribers can push you past that limit in one campaign.
What should a compliant opt-in checkbox say?
Use a positive, specific sentence next to an unchecked box, such as “Yes, send me weekly offers from [brand] by email.” Name the brand, the kind of email and how often it will arrive, and mention that subscribers can unsubscribe at any time. If two brands are involved, give each its own box.
Sources
- Google Workspace Admin Help: Email sender guidelines
- Yahoo Sender Hub: Sender requirements and best practices
- Federal Trade Commission: CAN-SPAM Act, A Compliance Guide for Business
- Federal Register: FTC adjustments to civil penalty amounts (2025 levels kept for 2026)
- Microsoft Tech Community: Outlook’s new requirements for high-volume senders
- CRTC Compliance and Enforcement Information Bulletin 2012-549
- Court of Justice of the European Union: Planet49 judgment press release (C-673/17)