Here follows some text examples for use in Sign-up Flows, Checkouts etc.

These text examples are intended for use in user registration processes, online checkouts, membership sign-ups, and other consent-related interfaces where users must acknowledge privacy terms and marketing preferences. Depending on the legal strategy and risk tolerance, different approaches to collecting marketing consent are possible.

Alternative 1 – No explicit marketing consent collected (Legitimate Interest)

This approach relies on the lawful basis of legitimate interest (Article 6(1)(f) GDPR) for sending direct marketing communications, especially to existing customers under applicable marketing legislation (commonly referred to as the “soft opt-in” rule) where:

• The customer is informed but not asked to give consent.
• The checkbox can be mandatory to proceed.

Example wording:

• [☐] I confirm that I have reviewed the privacy policy [link] and the information about how my personal data is used and my rights in connection with this, including the processing of personal data for direct marketing purposes based on legitimate interest. I acknowledge that I can object to receiving direct marketing at any time by using the unsubscribe links provided in emails or SMS, or by contacting [contact@company.com].
• [☐] I confirm that I have reviewed and accept [Company]'s terms and conditions, as applicable from time to time.

Important notes:

• Advantage: You can send marketing to all customers automatically.
• Risk: If the opt-out mechanism is not perceived as easy enough at the time of collection, or in each subsequent email or SMS, this approach could be challenged.

Alternative 2 – Collecting explicit consent for marketing

This approach relies on the lawful basis of consent (Article 6(1)(a) GDPR) for sending direct marketing communications and collects explicit, freely given consent to marketing through a separate checkbox.

The acceptance of the terms and conditions can still be mandatory (because it's part of the contract), but the marketing consent must be optional and therefore separate. This avoids confusion, but also means you must not send marketing to users who do not opt in.

Example wording:

• [☐] I confirm that I have reviewed the privacy policy and the information about how my personal data is used and my rights in connection with this.
• [☐] I consent to receiving direct marketing communications via SMS and email. I understand that I can withdraw my consent at any time by using the unsubscribe links provided in emails or SMS, or by contacting [contact@company.com].
• [☐] I confirm that I have reviewed and accept [Company]'s terms and conditions, as applicable from time to time.

Important notes:

The marketing consent checkbox must be optional and not pre-ticked.

No marketing can be sent to users who do not check the box.

Article last updated 02 May 2025 07:50