Email consent checkbox generator: opt-in wording for GDPR and CASL
In short: Builds an unticked marketing-email checkbox with what you'll send, how often and how to withdraw, CASL's identification line where needed, the HTML, and the fields to store as proof of consent. Limit: It writes wording from the regulators' guidance; it can't assess your whole form or privacy policy.
An email consent checkbox is the unticked box on a form that a person ticks to agree to marketing email. GDPR needs it specific, informed and separate from your terms, with withdrawal as easy as agreeing; CASL also wants your name, mailing address and a contact method in the request. Enter your details to get the wording, HTML and record fields.
Price: this tool is free. Checking a whole email list is from $9/mo, and the first 100 checks are free with Google, no card. See pricing
Built in your browser as you type. Nothing is sent anywhere. Not legal advice.
The checkbox
You can unsubscribe at any time with the link in every email. See our privacy policy for how we use your data: [privacy policy URL]
<label class="consent"> <input type="checkbox" name="email_consent" value="yes"> Yes, email me our newsletter from [Your company]. </label> <p class="consent-note">You can unsubscribe at any time with the link in every email. See our privacy policy for how we use your data.</p>
Store this with every sign-up
email
- Why
- Whose consent it is.
consented_at
- Why
- When they agreed (UTC timestamp).
consent_text
- Why
- The exact wording shown, or a version ID that points to it.
form_url
- Why
- Where they agreed.
method
- Why
- How: unticked box ticked, double opt-in confirmed.
withdrawn_at
- Why
- When they unsubscribed, so a re-import can't bring them back.
| Field | Why |
|---|---|
| Whose consent it is. | |
| consented_at | When they agreed (UTC timestamp). |
| consent_text | The exact wording shown, or a version ID that points to it. |
| form_url | Where they agreed. |
| method | How: unticked box ticked, double opt-in confirmed. |
| withdrawn_at | When they unsubscribed, so a re-import can't bring them back. |
Before it goes live
Pass: The box starts unticked
Pre-ticked boxes, silence or inactivity aren't consent under GDPR, and CASL doesn't accept a pre-checked box either.
GDPR Recital 32: Conditions for consentCheck: Keep the box separate from accepting your terms
Consent bundled into terms and conditions isn't freely given. The marketing box must be optional and the order or account must work without it.
GDPR Article 7: Conditions for consentPass: It says how to withdraw
Withdrawing has to be as easy as giving consent, and CASL requires the request to say consent can be withdrawn.
GDPR Article 7: Conditions for consentFix: Add your privacy policy link
Consent has to be informed: who you are and what you'll do with the address, a click away.
GDPR Article 7: Conditions for consentYours to confirm: Store the record for every sign-up
You have to be able to show who agreed, when, where and to what wording. Store the fields listed above with each contact.
GDPR Article 7: Conditions for consent
Next step
New sign-ups get the box. The contacts you already have need a check.
Addresses collected before the form changed may be typos, closed inboxes or fake sign-ups. Drop the existing list here to see which addresses still exist before you email it.
No list right now? This tool stays free, no account, so bookmark it for next time. Ctrl+D (⌘+D on a Mac)
Ready to verify now? Verify the list
Sample result
An unticked opt-in box for Northwind's newsletter and offers, with CASL's identification line under it.
- Checkbox
- Unticked
- Record fields
- 6
- Formats
- Text, HTML
What this means for you
Paste it into the sign-up form and store the six record fields with each sign-up.
- Unticked by default
- What, how often, how to stop
- CASL identification line
- Consent record fields
- GDPR
- CASL
- HTML
By SimpleVerifier Team · Last updated · Runs in your browser; nothing you paste is sent to us
Also in: Português (Brasil) · Español · Deutsch · Français
What about the contacts collected before the new box?
- The new checkbox covers sign-ups from today. Existing contacts keep whatever consent they gave then.
- Upload the existing list at /verify for a live mailbox check on every address before you email it. The first 100 email checks are free with a Google sign-in, no card.
- Send a re-permission email to contacts whose consent you can't show, and suppress the rest.
How do I write a GDPR-compliant email opt-in checkbox?
- Choose the law to write for: UK or EU GDPR, Canada's CASL, or both.
- Enter your brand, what you'll email (newsletter, offers, product news, events), how often, and your privacy policy link. For CASL, add your mailing address and an email, phone or web address.
- Copy the wording or the HTML snippet into your form. The box starts unticked.
- Store the listed fields with each sign-up so you can show the consent later, and fix anything the checks flag.
Example
- You enter
- Law Both, brand
Northwind, newsletter and offers, about once a week, privacy policyhttps://northwind.example/privacy, mailing address100 Example Street, Toronto, ON M5V 0A0, contact[email protected]. - You get
- Checkbox: "Yes, email me our newsletter and special offers from Northwind, about once a week." The line under it gives the unsubscribe statement, Northwind's mailing address and contact, and the privacy policy link; an unticked HTML snippet; six consent record fields; checks all pass except the reminder to store the record.
- Limits
- Runs in your browser as you type; nothing is sent.
What should an email consent checkbox say?
It should say what they'll get, from whom, and how to stop: "Yes, email me our newsletter and special offers from Northwind, about once a week. You can unsubscribe at any time with the link in every email." GDPR consent has to be specific and informed (Article 7), so vague wording like "marketing communications from us and selected partners" doesn't do the job.
The box starts unticked and stays optional. Recital 32 says pre-ticked boxes and silence don't count as consent, and the ICO adds that consent shouldn't be a condition of signing up for something else. Under CASL, the CRTC's bulletin 2012-549 says a pre-checked box isn't express consent either.
What does CASL require in a consent request?
Three things, according to the CRTC's bulletin 2012-548 and the Electronic Commerce Protection Regulations: the purpose for which consent is sought, the name of the person seeking it (and anyone it's sought on behalf of) with a mailing address and a phone number, email address or web address, and a statement that consent can be withdrawn. The generator puts the identification line under the box when you pick CASL.
Express consent under CASL doesn't expire, but implied consent from a purchase or enquiry does. See CASL and cold email for when implied consent applies.
How do you prove someone gave consent?
Keep a record per contact: who, when, where, the wording they saw and how they agreed. The ICO's consent guidance lists the same items. The generator gives the fields to add to your sign-up table or email platform: consented_at, consent_text (or a version ID), form_url, method and withdrawn_at.
Double opt-in adds a confirmation click to the record and keeps typo and fake addresses off the list. The double opt-in email generator writes the confirmation email.
GDPR and CASL opt-in boxes compared
| GDPR (UK and EU) | CASL (Canada) | |
|---|---|---|
| Pre-ticked box | Not consent | Not express consent |
| Purpose stated | Required (specific, informed) | Required |
| Who's asking | In the privacy information | Name, mailing address and a phone, email or web address |
| Withdrawal | As easy as giving consent | Say consent can be withdrawn |
| Expiry | None set; refresh as needed | Express: none. Implied: 2 years or 6 months |
Who uses this tool, and for what?
- Ecommerce stores
- Add an optional newsletter box at checkout that doesn't block the order, with the wording saved for each customer.
- SaaS signups
- Separate product marketing consent from accepting the terms on the sign-up form.
- Canadian senders
- Get CASL's identification line under the box without rewriting the form copy.
- Agencies
- Hand clients a consent box and the record fields for their landing pages in one go.
What can’t this tool tell you?
- It writes wording from the regulators' guidance; it can't assess your whole form or privacy policy.
- It covers GDPR and CASL. US forms usually follow CAN-SPAM, which doesn't require consent for email.
- SMS consent has its own rules; use the SMS opt-in generator for text messages.
- New wording doesn't fix consent for contacts collected before it.
Common questions
- Do I need a checkbox for GDPR?
- You need a clear affirmative act. A separate unticked box is the usual way when the form does something else too, such as checkout or account sign-up. On a form whose only purpose is the newsletter, pressing Subscribe next to clear wording can be the act.
- Can the consent checkbox be pre-ticked?
- No. GDPR Recital 32 says pre-ticked boxes aren't consent, and the CRTC says the same for CASL express consent.
- Can I make consent to marketing a condition of buying?
- Under GDPR, consent tied to a service that doesn't need it isn't freely given. Keep the marketing box optional and let the order go through without it.
- What is the opt-in wording for CASL?
- State what you'll send, identify yourself with your name, mailing address and a phone number, email address or web address, and say consent can be withdrawn at any time.
- Is this legal advice?
- No. The wording follows the regulators' published guidance, linked on the page. Check it with your adviser if your forms or audience are unusual.
Sources
A tidy list can still be full of dead addresses.
Extracting, deduplicating and syntax checks all work on the text of an address. None of them can tell whether the mailbox exists. Only the server that hosts it can answer that, through an SMTP check, and that is what the paid product does.
- Upload the cleaned file as it is: CSVs up to 100,000 rows
- A real SMTP mailbox check on every row, with catch-all detection
- Small list? Starter at $9/mo covers 2,500 emails a month, cancel anytime
Plans from $9 a month, cancel anytime, no contract. Sign in with Google and your first 100 email checks are free, no card. The free tools stay free either way.