A signup form with one checkbox that tries to cover email permission, tracking, and terms in a single sentence is a small monument to a common confusion. Three different legal ideas were squeezed into one tick, and the tick ends up proving none of them cleanly.
Separate the permissions and each one gets simpler. The form gets shorter too, which surprises people.
What email signup consent must show
You need to be able to prove who consented, when, and to what. That means the wording beside the form at the moment of signup matters, and it should be kept, screenshotted or versioned, not rewritten casually next quarter. Under GDPR style rules the standard is a clear affirmative action; a pre ticked box is not one, as European courts have confirmed in plain terms.
Double opt in, the confirmation email loop, is not legally required everywhere, but it is the strongest evidence a small site can produce and it filters out mistyped and malicious signups at the same time. For most lists it is cheap insurance that also improves list quality.
The tracking pixel problem nobody puts on the form
Most email platforms embed an open tracking pixel by default. That pixel is tracking, and in stricter jurisdictions it needs its own consent basis, separate from permission to send the email itself. Many senders have never made this decision on purpose. The platform made it for them in a settings page they have never opened.
Decide deliberately. Either disclose tracking plainly in the signup wording and privacy notice, or turn open tracking off and accept that open rates become unreliable, which, between pixel blocking and image prefetching by major mail clients, they largely already are.
The banner does not fix the form
Accepting cookies on your site does not create email marketing consent, and an email signup does not set cookie consent. Teams conflate them because both involve the word consent and a checkbox shaped object. Regulators do not conflate them, and a complaint investigation will pull both records and judge each on its own rules.
If your signup form drops marketing cookies or fires advertising tags on submit, that activity belongs to the cookie consent system and must wait for it. A form submit is not a tracking permission slip.
Withdrawal has to be as easy as signup
Every marketing email needs a working unsubscribe, and honoring it promptly is part of the consent record, not an afterthought. Keep suppression lists even after deleting marketing data: the record that someone opted out is the thing that stops a future import from emailing them again.
Test your own unsubscribe quarterly, from a real inbox, and time it. If it takes a login, a preference centre maze, or more than a couple of clicks, it is not as easy as signup was, and that asymmetry is exactly what regulators quote.
Related reading
These earlier guides go deeper on connected questions: Consent for Embedded Maps and Videos: The Third Parties Inside Your Pages An embedded map or video phones home to a third party the moment it loads, consent or not. How two click solutions and placeholders keep embeds useful without leaking visits., Consent Banner Timing: Asking Before or After the First Page View Show the banner instantly and you interrupt everyone; delay it and you may track before consent exists. The timing options, what the rules actually require, and a defensible middle path., and Granular Consent Toggles Without Dark Patterns Granular choice is a legal expectation and a design minefield. How to offer category toggles that inform rather than steer, and the patterns regulators keep naming..
Frequently asked questions
Is a pre ticked signup box valid consent?
Under GDPR style standards, no. Consent requires a clear affirmative action, and a pre ticked box is not one. Use an unticked box or an unambiguous signup statement that makes clear what the person is agreeing to receive.
Does email signup consent cover tracking pixels?
Not automatically. Open and click tracking is a separate processing activity that stricter jurisdictions treat as needing its own basis and disclosure. Review your email platform's tracking settings rather than assuming the defaults match your privacy notice.
Do I need double opt in?
It is not required in every jurisdiction, but it produces the cleanest proof of consent and removes mistyped and fake addresses. For most small and mid sized lists, the evidence and list quality benefits outweigh the small drop in raw signup numbers.
How long should I keep consent records?
For as long as you rely on them, meaning while the person remains on your list, plus a defensible period after. Keep the wording version, date, and source of signup. Suppression records for people who opt out should be kept so they are not re added.