When you complete a form online, it is usually to gain access to a good or service. The exchange of personal information is, to an extent, the price you pay over and above the actual cost of the product. In theory, an ecommerce company might only need your address and payment information, and an online-only service might only need a username and payment details. There’s no reason my name is needed when ordering a new toothbrush - it’s not inscribed in it, and no one else lives at my exact address. You might need to ring me if there are problems with the delivery, but couldn’t you just email me instead?

But, alas, this is rarely the case. We know that businesses want to market to us, and a lot of the time we are happy for this to happen. This is because the range of goods or services a company provides may be of genuine interest to us, but it's also understood that this is part of the bargain, and we can choose to no longer receive marketing from those companies if we so choose.

So, at the end of a form usually sits a final question relating to future communications between you and an online company. In essence, these questions surround your willingness to be contacted in future by this company, or others. It is the start of you handing over ownership, or at least management, of your personal information.

Typically there are two ways in which companies can do this when creating a form.

For more advice on improving your form's performance, take a look at Zuko's comprehensive guide to Form Optimization

‍

Opt in

Opting in means that a user has to actively take action in order to show their consent.

For example:

In the above, a user has to actively click the each of the above checkboxes in order to signify their consent to receive information via email, phone or text. Ticking each box means you want the thing its offering. By doing nothing, the user would receive no further comms.

‍

Opt out

Opting out means that someone has to actively take action in order to withdraw their consent for something. For example:

If the user does not want to receive any further communication they have to actively tick the above boxes. By doing nothing, they will be opted in.

This last part is key - by doing nothing, the user is opted in. This means that some forms, visually at least, give the impression that a user has ticked a checkbox to receive marketing information or have their details passed on, but that checkbox is ticked by default:

The above are selected by default, meaning if the user does nothing, they will be opted in, in effect making this an opt out version of consent.

‍

Should you choose opt in or opt out?

First, let’s approach this from an online brands point of view, with their objective being to increase the number of people they can market to. The prevailing wisdom says that people tend to go with the default, and therefore offering opt-out marketing preference would likely increase the size of your audience more quickly. There’s science to back this thought process up.

Dan Ariely, and professor of psychology and behavioural economics, has discussed an interesting phenomenon around the percentages of people in European Countries who are willing to donate their organs after they pass away.

Here’s the graph showing the relative opt in rates:

As you can see, the countries on the left have significantly lower percentages of people that consent to donate their organs. Those of the right average over 95%. Why such a gulf? In countries where the form to become an organ donor is set as opt-in, where you have to choose to become an organ donor, people do not check the box and therefore do not become a part of the donor programme. In countries where the default is opt-out, people also do not check the box but do become a part of the program.

The point of this is to highlight even for important and emotive decisions, people tend to go for the default option. Forrester Research that found only 18% of customers respond to opt-in or opt-out requests, regardless of which is present on a form. This means that you can either communicate further with 18% of customers that choose to opt-in, or with 82% (those that decided not to opt-out).

One study found that open rates for opt-in businesses were 82% higher than open rates received by opt-out businesses. Click through rates were 100% higher for opt-in businesses. This suggests that while you can communicate with fewer customers, you have a far more captive and engaged audience when you let them opt-in. 

So you seemed to be faced with a larger marketing audience who are less engaged, or a smaller more responsive audience.  But there are now legal considerations too.

‍

GDPR and the Law

GDPR and more recently CCPA have been introduced to improve the ability of customers to have control over their own data. It has had far reaching impacts and caused many a redesign 

According to the ICO, the latter of the law states that consent ‘must be freely given, specific, informed, and there must be an indication signifying agreement’. They give further information and state that consent must meet the following criteria:

• Active opt-in: pre-ticked opt-in boxes are invalid – use unticked opt-in boxes or similar active opt-in methods (eg a binary choice given equal prominence). 
• Granular: give granular options to consent separately to different types of processing wherever appropriate. 
• Named: name your organisation and any third parties who will be relying on consent – even precisely defined categories of third-party organisations will not be acceptable under the GDPR. 
• Documented: keep records to demonstrate what the individual has consented to, including what they were told, and when and how they consented. 
• Easy to withdraw: tell people they have the right to withdraw their consent at any time, and how to do this. It must be as easy to withdraw as it was to give consent. This means you will need to have simple and effective withdrawal mechanisms in place. 
• No imbalance in the relationship: consent will not be freely given if there is imbalance in the relationship between the individual and the controller – this will make consent particularly difficult for public authorities and for employers, who should look for an alternative lawful basis
  

So some quite clear guidelines above, and the previous example seems to fit into the first three guidelines well:

Active opt-in: the user has to tick each box to opt in

Granular: the different channels of communication are listed separately

Named: the organisation is named

The next two guidelines are almost certainly ones that happen after this point - unsubscribe links in an email for example, and centralised documentation of the type of consent given by each user.

But, despite the above guidance, there seems to be plenty of sites that have marketing preference sections of their form like this:

And this:

The above examples are definitely opt out options. The first is a pre-ticked box opting a user in, the second a user has to tick the box to be opted out.

This seems to directly contradict the guidance before - so what’s going on?

‍

Soft Opt In

Well, this being the law and all, things are rarely that simple.

The ICO also provides some guidance on what is known as a ‘Soft Opt In’ with their definition being (emphasis ours):

“The term ‘soft opt-in’ is sometimes used to describe the rule about existing customers. The idea is that if an individual bought something from you recently, gave you their details, and did not opt out of marketing messages, they are probably happy to receive marketing from you about similar products or services even if they haven’t specifically consented. However, you must have given them a clear chance to opt out – both when you first collected their details, and in every message you send.

The soft opt-in rule means you may be able to email or text your own customers, but it does not apply to prospective customers or new contacts (eg from bought-in lists). It also does not apply to non-commercial promotions (eg charity fundraising or political campaigning).”

The latter part seems clear enough - you cannot buy lists of customers’ details and then bombard them with marketing information with no prior contact or way for them to choose not to receive this.

But the first part and in particular the part in bold still seems open to interpretation. It seems as if many online brands are taking ‘bought something from you recently’ as ‘at the point of buying for the first time’ with ‘buying’ often meaning enquiring or signing up. In other words, even though I haven’t bought something from a brand weeks or months ago, at the point I submit the form for the first time on a site, I’m effectively becoming a customer and therefore any future marketing emails are to an existing customer, not a new one, so the customer does not have to opt in specifically so long as they can opt out in future. Got it? I know, it’s a mouthful, and very very grey.

‍

Effective, but ethical?

There seems to be a sliver of wiggle room within the guidelines to go for an opt out marketing preference box in your form. It is far from certain whether or not this fits with the spirit of customers having better control of their data. Customers should know the consequences of submitting a form on your site, not just immediately, but what happens afterwards too. The age of small print which customers do not read seems to be coming to an end, with brands being forced to be upfront, honest, clear, concise and unambiguous with how they handle customer data. Why not be ahead of the legal curve, and stick with opt in for everyone?

Further reading:

https://ico.org.uk/for-organisations/guide-to-pecr/electronic-and-telephone-marketing/