A signup form uses pre-ticked boxes to collect consent for optional analytics cookies and partner offers. What is wrong with this approach under GDPR consent rules?
Select an answer to reveal the explanation.
Short Explanation
Pre-ticked boxes are the old 'we assume you said yes' trick—and GDPR isn't buying it. Consent needs a clear opt-in you actually choose, and saying 'never mind' later should be just as easy. Untick-by-default isn't real consent.
Full Explanation
Valid consent must be freely given, specific, informed, and unambiguous. Pre-ticked boxes that collect consent for optional analytics cookies and partner offers generally fail the unambiguous affirmative-act standard because the data subject has not clearly signalled agreement; silence, pre-selection, or inactivity is not consent. Withdrawal of consent must also be as easy as giving it, which buried or asymmetric flows undermine.
Pre-ticked boxes are not ideal under EU consent doctrine. The idea that boxes may be pre-ticked only for special-category data reverses the protective logic—sensitive processing demands stricter, not looser, care. Partner-offer consent still needs to be specific; a privacy policy longer than ten pages does not replace granular, affirmative choice.
Exam caveat: unticked opt-in is the exam-safe pattern for consent-based optional processing. Operational check: remove pre-ticks, separate cookie and partner purposes, present clear yes/no choices, and provide equally easy withdrawal in the same interface family. Public-facing city services should model clean consent UX rather than dark patterns that erode civic trust in how the municipality asks for permission.