At a glance
No — a pre-checked newsletter or marketing box isn’t valid consent under India’s DPDP Act. Consent has to be a clear, affirmative choice you actually make, so a box already ticked when you reach the form — one you’d have to notice and un-tick — doesn’t count. Ticking you in by default and treating your silence as a yes isn’t the free, unambiguous agreement the law requires. If you never actively opted in, you can withdraw, and a legitimate business has to honour it.
Educational resource only. This explains how India’s Digital Personal Data Protection Act, 2023 (DPDP Act) treats pre-checked consent boxes; it is not formal legal advice.
The situation
You fill in a form to buy something or create an account, hit submit, and later realise you’re getting marketing emails you don’t remember asking for. Scroll back and there it was: a little “keep me updated with offers” box, already ticked, that you never actually chose. It’s one of the oldest tricks in the signup playbook — and under India’s data-protection law, it doesn’t hold.
Why a pre-ticked box isn’t consent
Consent under the DPDP Act has to be an active, unambiguous choice — a box someone ticked for you in advance is neither. The Act requires consent to be free, specific and unambiguous (Section 6): a clear signal that you agreed to a particular use of your data. A pre-checked box inverts that. Instead of you choosing to opt in, the business opts you in and hopes you don’t notice to opt out. That’s the opposite of an affirmative choice, so the “consent” it records isn’t valid for the marketing it’s trying to authorise. The law is designed to catch exactly this — agreement manufactured by default rather than actually given.
“But I didn’t un-tick it” — silence isn’t a yes
Not objecting to something you never noticed isn’t the same as agreeing to it. The whole point of a pre-ticked box is that it relies on your inattention: you were focused on the purchase or the signup, not hunting for a switch to turn off. Treating “they didn’t un-tick it” as consent turns your silence into a yes, which the unambiguous-consent standard doesn’t allow. Real consent needs a positive act from you — ticking the box yourself, flipping the toggle on, clicking the specific opt-in. If the only thing the business can point to is that you failed to opt out, they don’t have your consent for that extra use.
Where you’ll still run into them
The rule is clear, but pre-ticked boxes haven’t vanished — you’ll still meet them, especially on older or overseas forms. Plenty of signup flows, checkout pages, and app onboarding screens were built before the DPDP Act and never revisited, and some businesses simply haven’t caught up. You’ll most often see them attached to marketing consent (“send me offers”), data-sharing with “partners,” or a bundled “I agree to everything” that quietly includes promotions. The box being there doesn’t make the resulting consent valid — but it does mean you have to stay alert on the form, because a pre-ticked box only works on people who don’t spot it. Spotting it is most of the defence.
What you can do about it
You can un-tick it now, withdraw later, and stop the messages either way — the controls are on your side.
- Scan before you submit. On any signup or checkout, glance for boxes that are already ticked — especially near “offers,” “updates,” or “partners” — and un-tick anything you didn’t actively want.
- Withdraw consent you never really gave. If you’re already getting marketing you didn’t choose, you can withdraw consent — the Act requires it to be as easy to withdraw as it was to give.
- Use the unsubscribe link. Every legitimate marketing email must offer a way out; unsubscribing is the fastest stop for email.
- Escalate if they ignore you. A business that keeps messaging after you’ve withdrawn, or can’t show you ever actively opted in, is on the wrong side of the rule — you can raise a grievance with them and, if unresolved, take it further.
FAQ
Are pre-checked consent boxes actually illegal in India?
They don’t produce valid consent under the DPDP Act, because consent must be an unambiguous, affirmative choice. A box that’s ticked by default and relies on you not un-ticking it doesn’t meet that standard, so the consent it claims to capture isn’t good for the extra use.
If I forgot to un-tick a box, did I agree?
No. Failing to notice and un-tick a pre-ticked box isn’t agreement — that’s silence, and the law needs a positive act. You can withdraw and unsubscribe, and the business has to honour it.
Why do companies still use them if they don’t count?
Habit, old forms never updated, and the hope that most people won’t notice. The box being present doesn’t make the consent valid; it just means you should check every form and un-tick what you didn’t choose.
How do I stop marketing I never signed up for?
Un-tick the box if you catch it, use the unsubscribe link on emails, and withdraw consent directly with the business — it has to be as easy to withdraw as to give. If they keep going, raise a grievance.