Good email consent wording names who is sending, what will be sent, roughly how often, and how to stop — in one plain sentence, next to an unticked box the person chooses to tick. If your checkbox says "I agree to receive communications," it is too vague to prove anything later. This guide gives wording you can adapt, and the patterns that fail.
This article explains common requirements in plain language. It is not legal advice — consult qualified counsel for your jurisdiction and situation.
What consent wording is actually for
Two things, and they pull in the same direction.
The compliance job is evidentiary. Under frameworks like GDPR, consent has to be freely given, specific, informed, and unambiguous — and you have to be able to demonstrate it after the fact. Wording is most of "specific" and "informed," and an unticked box is most of "unambiguous."
The commercial job is expectation-setting. People mark mail as spam when it does not match what they thought they agreed to. Precise wording at signup is the cheapest complaint-rate reduction available, and complaint rate is the single strongest negative signal mailbox providers use.
The four elements of a working consent line
- Who. Name the actual sending entity. "We" is ambiguous on a page with three logos. Use the business name.
- What. Describe the content type concretely — "product updates," "monthly market reports," "offers on outdoor gear" — not "communications" or "information."
- How often. A rough cadence prevents the two most common complaints: too frequent, and forgot you existed. "About twice a month" is enough.
- How to stop. One clause: "unsubscribe anytime." It costs a few words and measurably lowers hesitation at the form.
A privacy policy link is standard practice alongside these, but a link does not substitute for the sentence. Nobody reads the policy at the moment of signup, and regulators generally expect the essential information to be visible at the point of consent.
Wording you can adapt
| Scenario | Checkbox wording |
|---|---|
| General newsletter | Yes, email me the Northwind newsletter — practical marketing tips, about twice a month. Unsubscribe anytime. |
| Ecommerce signup | Yes, send me new arrivals and sale alerts from Harbor Goods, roughly weekly. Unsubscribe anytime. |
| Lead magnet download | Send me the pricing checklist. I'd also like Northwind's monthly pricing tips — unsubscribe anytime. (Separate box for the ongoing list.) |
| Checkout add-on | Keep me posted on new products and offers from Harbor Goods, about twice a month. This is optional and won't affect your order. |
| Event or webinar | After the session, email me related resources and future event invites from Northwind. Unsubscribe anytime. |
| B2B demo request | Yes, I'd like product updates and case studies from Northwind, about monthly, in addition to follow-up about my demo. |
| In-person or paper signup | Email me Harbor Goods offers and store news, roughly monthly. Unsubscribe anytime. Email: ______ |
Two things to notice. Each one names the sender, and each one describes content someone could picture. If you cannot describe what you will send in five concrete words, you do not yet know what the list is for — and that is a strategy problem, not a copy problem.
Wording that fails, and the fix
| Fails | Why | Fixed |
|---|---|---|
| I agree to receive communications. | Not specific — proves nothing about what they agreed to | Email me Northwind product updates, about monthly. |
| By submitting, you agree to receive marketing emails. | Consent bundled into an unrelated action | Separate, unticked box beside the submit button |
| Uncheck this box if you do NOT want emails. | Opt-out framing; double negative is deliberately confusing | Unticked opt-in box with positive wording |
| I agree to the Terms, Privacy Policy and to receive offers. | Bundles marketing consent with contract acceptance | Two boxes: one for terms, one optional for marketing |
| Sign up for exclusive VIP insider access! | Says nothing about email frequency or content | Name the content and cadence plainly |
| We may share your details with trusted partners. | "Partners" is unnamed, so consent cannot be specific | Name the third parties, or do not share the data |
Design traps around the box itself
- Pre-ticked boxes. Treated as invalid consent under GDPR and widely disfavored elsewhere. Leave every marketing box unticked.
- Bundled consent. Making marketing consent a condition of downloading, buying, or entering breaks "freely given." Marketing consent should always be genuinely optional.
- Visual manipulation. A large bright "Yes" and a tiny grey "No thanks" is a dark pattern, and regulators have taken an increasingly dim view of it. Give both options equal visual weight.
- Hiding the box. Consent text set in 9px grey below the fold is technically present and practically invisible. Keep it legible and adjacent to the field.
- Silent scope creep. Consent obtained for a newsletter does not cover a partner's promotional blast. If the purpose changes materially, ask again.
- One box for many brands. If you operate several brands, name each one or take separate consent per brand.
How the major frameworks differ
| Framework | Region | Consent model | Wording implication |
|---|---|---|---|
| GDPR / ePrivacy | EU and EEA | Opt-in; specific, informed, unambiguous, demonstrable | Granular, unticked, named sender and purpose |
| UK GDPR / PECR | United Kingdom | Opt-in, with a narrow existing-customer exception | Same as GDPR; the exception is narrower than most assume |
| CAN-SPAM | United States | Opt-out; no prior consent legally required | Accurate sender and subject, working unsubscribe, postal address |
| CASL | Canada | Express or implied consent, with expiry on implied | Identify sender, state purpose, keep dated records |
| Australian Spam Act | Australia | Express or inferred consent | Clear identification and functional unsubscribe |
If any part of your list is in the EU or UK, the practical move is to write to the stricter standard for everyone. Maintaining two form variants and two consent databases creates more risk than it saves, and clearer wording lowers complaints on every list regardless of jurisdiction. There is a fuller walkthrough in our guide to GDPR email marketing in the EU.
Recording consent so it can be proven
Wording only helps if you can show what a specific person saw and agreed to on a specific day. Store these fields with every contact:
- Timestamp of consent, with time zone
- The exact consent text shown, or a version identifier pointing to it
- Source — form URL, in-store tablet, event name, import batch
- IP address or equivalent, where lawful to collect
- Which optional boxes were ticked, individually
- Confirmation record if you use double opt-in
- Any later change, including unsubscribe and preference updates
Version your consent text like code. When you change the wording, keep the old version so contacts from 2024 are still linked to what they actually read. This costs nothing at the time and is the difference between a five-minute answer and a scramble if you are ever asked.
Double opt-in is not universally required, but it is worth using where the source is less controlled — paid lead generation, event scans, partner co-registration. It gives you a second timestamped record and filters typos and fake addresses before they hurt your bounce rate.
Frequently asked questions
Does an email consent checkbox have to be unticked by default?
Under GDPR, yes — pre-ticked boxes do not constitute valid consent because they are not an unambiguous affirmative action. Leaving marketing boxes unticked is good practice everywhere, since it also reduces later spam complaints.
Can I use one checkbox for terms and marketing consent?
You should not. Bundling marketing consent with terms acceptance means it is not freely given or specific, and it makes the consent much harder to defend. Use two separate boxes.
Do I need consent to email customers in the United States?
CAN-SPAM operates on an opt-out model, so prior consent is not strictly required, but you must identify yourself accurately, avoid deceptive subject lines, include a postal address, and honor unsubscribes promptly. Consent-based sending still performs far better.
What should I record when someone gives consent?
Store the timestamp, the exact consent wording shown, the source of the signup, which optional boxes were ticked, and any later changes. Versioning your consent text means old records stay tied to what that person actually read.
Does implied consent expire?
Under CASL, implied consent has defined expiry periods depending on how it arose, such as an existing business relationship. Because the rules differ by jurisdiction and situation, treat express consent as the safer default and check specifics with counsel.
Build compliant signup flows without wiring it all yourself. Start with IGSendMail — GDPR, CAN-SPAM and CASL compliant, consent records built in, and 99% inbox deliverability from $19/mo.
