united-kingdom online
Can opt-in/opt-out checkboxes be deliberately obscure?
<p>Is this legal in the UK:</p>
<p><a href="https://i.stack.imgur.com/6qu9y.png" rel="noreferrer"><img src="https://i.stack.imgur.com/6qu9y.png" alt="enter image description here" /></a></p>
<p><a href="https://booking.hollywoodbowl.co.uk/ashford/register" rel="noreferrer">hollywood bowl's sign up page</a> asks for confirmation like this</p>
<blockquote>
<p>unless you tick the relevant box(es) below (or subsequently unsubscribe), you will receive exclusive discounts, offers and updates from us.<br />
[] Email [] SMS [] Phone</p>
</blockquote>
<p>The default state is that none of the boxes are checked which, according to the confusing wording of the paragraph, would mean that you are by-default opted-<em>in</em> to all promotional messages.</p>
<p>Are there any legal problems with this method of collecting permission for promotional spam?</p>

<h2>Not Allowed Under the GDPR</h2>
<p>The suggested method does not seem to comply with the GDPR, and would not be lawful for a Data Controller that is subject to the GDPR.</p>
<h2>Specific  Provisions</h2>
<p>Let's consider some specific provisions of the GDPR:</p>
<h3>Article 4</h3>
<p><a href="https://gdpr-info.eu/art-4-gdpr/" rel="noreferrer">Article 4</a>  paragraph (11) states:</p>
<blockquote>
<p>&quot;consent&quot; of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her;</p>
</blockquote>
<p>If the choice is &quot;obscure&quot; then it is not clear, and legal consent has not been given.</p>
<h3>Article 7</h3>
<p><a href="https://gdpr-info.eu/art-7-gdpr/" rel="noreferrer">Article 7</a> paragraph 3 reads:</p>
<blockquote>
<p>The data subject shall have the right to withdraw his or her consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Prior to giving consent, the data subject shall be informed thereof. It shall be as easy to withdraw as to give consent.</p>
</blockquote>
<p>It does not appear in the situation described that the data subject has been clearly informed that consent is being given.</p>
<h3>Recital 42</h3>
<p><a href="https://gdpr-info.eu/recitals/no-42/" rel="noreferrer">Recital 42</a> reads in relevant part:</p>
<blockquote>
<p>In accordance with Council Directive 93/13/EEC a declaration of consent pre-formulated by the controller should be provided in an intelligible and easily accessible form, using clear and plain language and it should not contain unfair terms. ... Consent should not be regarded as freely given if the data subject has no genuine or free choice or is unable to refuse or withdraw consent without detriment.</p>
</blockquote>
<p>The specified means do not seem to comply with R42</p>
<h3>Recital 32</h3>
<p><a href="https://gdpr-info.eu/recitals/no-32/" rel="noreferrer">Recital 32</a> reads:</p>
<blockquote>
<p>Consent should be given by a clear affirmative act establishing a freely given, specific, informed and unambiguous indication of the data subject’s agreement to the processing of personal data relating to him or her, such as by a written statement, including by electronic means, or an oral statement. This could include ticking a box when visiting an internet website, choosing technical settings for information society services or another statement or conduct which clearly indicates in this context the data subject’s acceptance of the proposed processing of his or her personal data. Silence, pre-ticked boxes or inactivity should not therefore constitute consent. ...  If the data subject’s consent is to be given following a request by electronic means, the request must be clear, concise and not unnecessarily disruptive to the use of the service for which it is provided.</p>
</blockquote>
<p>The format in the question seems to rely on inactivity as a way of giving consent, and is surely not clear.</p>

<p>This is mostly compliant. While such a form fails to collect valid consent, consent is not necessary for some forms of direct marketing. Instead, an opt-out solution might be permissible. We can therefore ask</p>
<ol>
<li>whether an opt-out solution would be valid in this scenario; and</li>
<li>whether this opt-out was implemented validly.</li>
</ol>
<p>For this we have to look at the UK's Privacy and Electronic Communicatoins Regulations (PECR), which complement and particularize the UK GDPR and DPA 2018. PECR is largely an implementation of EU Directive 2002/58/EC, the ePrivacy directive.</p>
<p>Per section 22 of the PECR, <strong>direct marketing via email</strong> is forbidden unless the recipient consents or the following three factors are all fulfilled, known as a “soft opt-in”:</p>
<ul>
<li>“the contact details of the recipient [were obtained] in the course of the sale or  negotiations for the sale of a product or service to that recipient”</li>
<li>“the direct marketing is in respect to that [sender's] similar products and services only”</li>
<li>“the recipient has been given a simple means of refusing […] the use of his contact details for the purpose of such direct marketing, at the time that the details were initially collected, and […] at the time of each subsequent communication”</li>
</ul>
<p>The presented form does allow for an opt-out, and arguably fulfills the three criteria</p>
<ul>
<li>the account is used for booking a bowling alley, which is a sale of goods or services</li>
<li>the “discounts, offers and updates” will presumably relate only to the bowling alley's own similar services</li>
<li>an opt-out was provided at the time when the contact details were collected</li>
</ul>
<p>However, I would argue that this opt-out fails to be a “simple means of refusing” as it involves dark patterns. While the text is unambiguous, the form is clearly designed to suggest that no communication will be made unless the respective boxes are checked.</p>
<p>The <a href="https://ico.org.uk/media/for-organisations/documents/1555/direct-marketing-guidance.pdf" rel="noreferrer">ICO's guidance on direct marketing (PDF, last updated 2018)</a> has a fairly lax view of consent and opt-out, but I don't think this lax view holds up in the face of later court rulings. If we read the PECR's concept of “refusing” as an application of the GDPR right to object to direct marketing per Art 21(2) GDPR, then per Art 12(1) such communications shall be provided in a “concise, transparent, intelligible and easily accessible form, using clear and plain language”.</p>
<p>In summary, the email marketing is in principle allowed, but it's unclear whether it was implemented in a valid manner.</p>
<p><strong>Direct marketing via telephone</strong> has a different set of rules. Per section 19 of the PECR, use of automated calling systems is illegal without consent. But direct marketing with live calls is allowed under the conditions of section 21. For example, an opt-out must be respected, regardless of whether the recipient has indicated this directly to the caller or whether they have registered their number in the UK's Telephone Preference Service (<a href="https://www.tpsonline.org.uk/register" rel="noreferrer">https://www.tpsonline.org.uk/register</a>).</p>
<p>So offering an opt-out for phone marketing in a registration form is not strictly necessary, but still a good idea.</p>
<p>The rules on <strong>direct marketing via SMS</strong> are unclear to me, but I'd be inclined to argue that they are electronic mail.</p>
