skip to content

Under GDPR Art. 7, what is wrong with a newsletter sign-up bundled into acceptance of a service's terms of service?

level: middleimportance: should knowfreq 50%

answer

  1. clearly distinguishable request
  2. conditionality presumption
  3. one purpose, one choice
  4. Art. 7(2), Art. 7(4), Recital 43

basics

~20 s

Under the GDPR, a consent request inside terms of service must be clearly distinguishable (Art. 7(2)), and tying a service to consent for unnecessary processing undermines freedom (Art. 7(4)). A bundled newsletter checkbox fails both, so the consent is invalid.

solid answer

~50 s

Bundling fails several GDPR requirements at once. `Art. 7(2)` says that where consent is given in a written declaration that also concerns other matters, the request must be **clearly distinguishable** from them, in intelligible and easily accessible form and plain language; any part of the declaration that infringes the Regulation is not binding. `Art. 7(4)` requires *utmost account* of whether a service is **conditional on consent** to processing not necessary for it, and Recital 43 says consent is then *presumed not freely given*. A newsletter is not needed to provide the service, so making it part of accepting the terms ties the service to it. Recital 43 also presumes consent is not free where **separate consent** for different operations is not allowed. EDPB Guidelines 05/2020 say consent and contract *cannot be merged and blurred*. The fix: an unticked, separate newsletter option, with the service available either way.

go deeper

for a junior

Recall that consent must be separate from terms and conditions, and that a service should not depend on agreeing to unrelated marketing.

for a middle

Explain Art. 7(2), Art. 7(4) and the Recital 43 presumptions, and redesign a bundled sign-up into separate, unticked choices.

for a senior

Assess the fallout: the infringing part is not binding, Art. 7(1) puts proof on the controller, and a list built from bundled consent cannot be shown to be validly consented.

for a principal

Separate contract acceptance from consent collection across every sign-up surface, so growth teams cannot reintroduce bundling one form at a time.

## The scenario A service's sign-up page has one checkbox: *"I accept the Terms of Service and agree to receive the newsletter."* The user cannot create an account without ticking it. Under the GDPR (Regulation (EU) 2016/679), the newsletter's marketing processing relies on consent. The question is whether this consent is valid. ## What the text requires Three provisions and two recitals apply: - **`Art. 7(2)`**: if consent is given in a written declaration that also concerns other matters, the consent request must be *presented in a manner which is clearly distinguishable from the other matters*, in intelligible and easily accessible form, using clear and plain language. *Any part of such a declaration which constitutes an infringement of this Regulation shall not be binding.* - **`Art. 7(4)`**: when assessing whether consent is freely given, *utmost account shall be taken* of whether the performance of a contract, including the provision of a service, is **conditional on consent** to processing that is **not necessary** for that contract. - **`Art. 4(11)`**: consent must be freely given and specific. - **Recital 43**: consent is **presumed not to be freely given** if it does not allow separate consent to different processing operations despite that being appropriate, or if performance of a contract is dependent on consent that is not necessary for that performance. - **Recital 32**: when processing has multiple purposes, consent should be given for all of them. ## Why the bundled checkbox fails | Requirement | How the bundle fails it | |---|---| | Clearly distinguishable (`Art. 7(2)`) | The newsletter request is merged into the same sentence and control as the terms | | Freely given (`Art. 7(4)`, Recital 43) | Access to the service depends on agreeing to marketing that the service does not need | | Specific and granular (Recital 43, EDPB paras. 42-44) | Two different matters, a contract and a marketing purpose, share one choice | EDPB Guidelines 05/2020 on consent describe exactly this pattern as **bundling** consent with acceptance of terms, or **tying** a service to consent for unnecessary processing, which they call *highly undesirable*; where it happens, consent is presumed not freely given (para. 26). They add that the processing for which consent is sought *cannot become directly or indirectly the counter-performance of a contract*, and that *the two lawful bases, consent and contract, cannot be merged and blurred*. On granularity, the guidelines say data subjects should be free to choose which purposes they accept rather than consent to a bundle (para. 42), and that conflating purposes without seeking separate consent for each shows a lack of freedom (para. 44). Their Example 7 is close: a single request covering email marketing and sharing details with group companies is not granular and therefore not valid. ## The consequence If consent is invalid, the newsletter processing has **no lawful basis under consent**. `Art. 7(2)` also makes the infringing part of the declaration non-binding. Every address collected through the bundled box is a list the controller cannot show was validly consented to, which matters because `Art. 7(1)` puts the burden of demonstrating consent on the controller. ## A compliant design 1. **Separate the matters.** The terms of service are accepted as a contract; the newsletter gets its own control. 2. **Default to off.** The newsletter checkbox is unticked; the user must select it (Recital 32). 3. **Do not condition the service.** Account creation works whether or not the box is ticked. 4. **Inform at the point of choice.** Who sends it, what it contains, how often, and that the user can withdraw at any time (`Art. 7(3)`). 5. **Record it.** Keep evidence of the separate choice, the wording shown and the time. ## Where the line sits Not every combination is bundling. A single page can present several separate, unticked choices next to the terms; what matters is that each consent is **distinguishable**, **separately selectable** and **not a condition** of a service that does not need it. Whether some other lawful basis could carry marketing emails instead of consent is a separate question. ## Common mistakes - Assuming that because the user ticked *something*, consent exists for everything in the sentence. - Believing a clear privacy notice cures bundling. - Treating the terms of service as the place where marketing consent lives. - Offering the service only to those who accept marketing, and calling it a choice.

  • Under GDPR Art. 7(2), what happens to the rest of a declaration when its consent part infringes the Regulation?
    Only the infringing part is not binding: `Art. 7(2)` says any part of such a declaration which constitutes an infringement of the Regulation shall not be binding. The terms of service can stand as a contract; the bundled marketing consent does not, so the newsletter processing loses the consent it relied on.
  • Under EDPB Guidelines 05/2020, can one page ask for several consents alongside the terms?
    Yes, if each is granular: separately selectable, unticked by default, clearly distinguishable from the terms and not a condition of a service that does not need it. The guidelines' concern is conflating purposes into one choice (paras. 42-44) and tying a service to consent (para. 26), not the number of requests on one screen.

saying these in an interview costs you the question

  • One tick for terms and marketing is valid because the user did tick it.
  • A clear privacy notice makes bundled consent acceptable.
  • A service may refuse sign-up to anyone who declines the newsletter.
  • Consent requests may never appear on the same page as the terms.
  • Addresses collected through a bundled checkbox can still be mailed lawfully.