What voids or invalidates consent?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
You put a checkbox on your signup form. But a checked box doesn't automatically equal valid consent. Several things can strip that "yes" of its legal standing before you've sent a single email.
Pre-checked boxes are the most common problem. Under GDPR, the subscriber has to take an affirmative action. Failing to uncheck a box they never noticed doesn't qualify. Bundled consent fails for the same reason: if someone had to accept marketing emails to access your service, the consent wasn't freely given.
Vague or misleading language also voids consent. If subscribers didn't understand what they were agreeing to, it's not informed consent. Deceptive practices are worse. Promise a monthly roundup and then send daily blasts, and you've exceeded the scope of what people agreed to.
Scope creep is a real trap. If you collected consent for "weekly product updates" and you've expanded to daily promotions or added a second brand, you've outrun your original permission. Major changes in frequency, content type, or sender identity often require fresh affirmative consent.
Valid consent is specific, informed, and voluntary. Anything that undermines those three things makes it invalid, regardless of what box got technically checked. If you want to run your signup flow past someone, the Review My Emails SOS call is free and we'll look at it with you.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
