Opt in vs opt out: what each means for your emails and your trackers

Opt in vs opt out comes down to who has to act. Opt-in means nothing happens until the person says yes. Opt-out means it happens by default, and the person has to say stop.

For a small company that sends email and runs a few trackers, the two words decide what your sign-up form looks like, what fires when someone lands on your homepage, and what you can do with a list you bought. The EU and UK lean one way. The US leans the other. This guide puts the three side by side, with the cases where a form or an unsubscribe went wrong, and a check for your phone.

Opt in vs opt out: what each one means in practice

Opt-in looks like an empty checkbox next to “send me your newsletter”, or a button that says “yes, email me”. Until the person ticks or presses, nothing goes out. The company carries the job of asking.

Opt-out looks like a pre-ticked box, a line in the terms that says you’ll receive offers, or an email that simply arrives with an unsubscribe link at the bottom. The person carries the job of stopping it.

The same split applies to trackers. A banner that holds the advertising tags until the visitor clicks accept is opt-in. A site that runs the tags straight away and offers a link to turn them off is opt-out.

Email marketing in the EU: the GDPR asks for a yes first

Under the GDPR, consent is a clear affirmative action. The European Data Protection Board’s consent guidelines say that pre-ticked opt-in boxes are invalid, and that silence, inactivity or merely proceeding with a service cannot be regarded as an active indication of choice. The same document says consent cannot be obtained in the same motion as agreeing to terms and conditions, and that withdrawing it has to be as easy as giving it.

The Court of Justice said the same about cookies in Planet49, on 1 October 2019. A pre-checked checkbox which the user must deselect does not constitute valid consent, and selecting the button to enter a promotional lottery doesn’t count as consenting to the cookies that came with it.

So an EU sign-up form has an empty box and its own wording, kept apart from the terms. The GDPR compliance checklist post has the rest of the form.

Email marketing in the UK: PECR and the soft opt-in

The UK rule for email and text marketing sits in regulation 22 of the Privacy and Electronic Communications Regulations. Paragraph (2) says a person must not send unsolicited direct marketing by email to an individual unless the recipient has previously notified the sender that they consent. The ICO puts it in one line: you must not send marketing emails or texts to individuals without specific consent.

The ICO’s detailed guidance says what a valid yes looks like. You must not use pre-ticked opt-in boxes, silence or inactivity as evidence of consent. The consent should name you, say that it covers your email marketing, and be kept separate from the terms and conditions.

What the soft opt-in lets you do

Paragraph (3) of regulation 22 is the soft opt-in. It lets you email existing customers about similar products or services without a fresh yes, if all three of these hold:

• Where the address came from: You got it in the course of the sale or negotiations for the sale of a product or service.
• What you send: Only marketing for your own similar products and services.
• The way out: You offered a simple, free way to refuse when you collected the address, and you offer it again in every message.

The ICO adds the limits. The soft opt-in does not apply to prospective customers or new contacts, such as a bought-in list. People on a bought list must have given valid consent to receive marketing from you, by name, for the method you plan to use.

Since 5 February 2026 regulation 22 has a new paragraph (3A), inserted by the Data (Use and Access) Act 2025, that gives charities a soft opt-in of their own for messages that further their charitable purposes. The ICO’s pages say its guidance is under review because of the Act.

Regulation 23 covers the message itself. You can’t disguise or conceal who the message is from, and every message needs a valid address the recipient can use to say stop. The ICO’s checklist turns that into an unsubscribe link or a reply address, acted on promptly, and a “do not contact” list of everyone who has used it.

One more UK detail: the rules above are for individuals. The ICO says you can email or text any corporate body, while sole traders and some partnerships are treated as individuals.

Email marketing laws in the US: CAN-SPAM works the other way

The federal rule is the CAN-SPAM Act, and it doesn’t ask for consent before the first email. The FTC’s compliance guide lists eight requirements: accurate headers, honest subject lines, a statement that the message is an ad, a physical postal address, a way to opt out that subscribers and members can use too, prompt handling of opt-outs, and responsibility for anyone sending on your behalf. On members, the guide says that you don’t need to get members’ consent to send them marketing emails, but they can still opt out.

You have 10 business days to process a request. The mechanism has to keep working for at least 30 days after the message goes out. You can’t charge a fee, ask for anything beyond an email address, or require more than a reply or a visit to a single web page. The postal address can be a street address, a post office box registered with the postal service, or a registered private mailbox.

The guide’s penalty figure, as of its January 2024 edit, is up to $53,088 for each separate email that falls short.

A receipt or an account notice is transactional and sits outside most of the Act, as long as its routing information is truthful. If the subject line reads like an ad, or the transactional part isn’t up front, the guide treats the whole message as commercial.

Trackers follow the same split

In the EU and UK, the ePrivacy rule and PECR ask for consent before a site stores or reads anything on a visitor’s device that isn’t needed to run the service. The ICO’s guide says you cannot set non-essential cookies on your website’s homepage before the user has consented, and that consent has to be more than continuing to use the site. The tracking pixel post shows how to spot a tag that fires early.

In the US, the state laws work on opt-out. California’s Attorney General says a business that sells or shares personal information has to show a clear and conspicuous “Do Not Sell or Share My Personal Information” link, honour the Global Privacy Control signal from a visitor’s browser as a valid opt-out, and wait at least 12 months before asking an opted-out person to opt back in. Connecticut’s Attorney General says covered businesses have had to honour opt-out preference signals since 1 January 2025.

The cookie consent in the USA post goes through what that means for a banner.

What regulators have looked at

European cases are about a yes that wasn’t really a yes. US ones are about a stop that didn’t work.

On 12 January 2024 the ICO fined HelloFresh £140,000 over 79 million emails and 1 million texts sent in seven months. The ICO found that the opt-in statement did not make any reference to the sending of marketing via text, and that it was bundled with an age confirmation statement which was likely to unfairly incentivise customers to agree. Customers also weren’t told their data would be used for marketing for up to 24 months after cancelling.

In January 2026 the ICO announced two fines totalling £225,000. It found that Allay Claims sent 4,046,947 marketing texts without valid consent, with no simple way to refuse offered when details were collected, so the soft opt-in did not apply. That’s the third condition from the list above. It found that ZMLUK sent 67,772,285 emails using data from a third-party website where people saw a list of 361 partner companies and no way to choose which could contact them. The ICO treated that consent as neither specific nor informed.

In the US, on 14 August 2023 the FTC announced that Experian Consumer Services would pay $650,000 over allegations that it emailed people with free accounts, told them the messages contained important information about their account, and gave them no unsubscribe link. Samuel Levine, the FTC’s consumer protection director at the time, put it in one line: You always have the right to unsubscribe from marketing messages.

Check your own sign-up form in five minutes

Open your site on a phone, as a visitor would.

1. Find every place that collects an email address: footer newsletter box, checkout, a download gate, a contact form. Note each one.
2. Look at the box. If there’s a marketing checkbox, is it empty by default? If there’s no box and the wording says you’ll send offers, that’s an opt-out form, and it only works for US visitors.
3. Read the wording. Does it name your company and say it’s about marketing email? Is it separate from “I agree to the terms”?
4. Check the checkout. If you plan to rely on the UK soft opt-in, the refusal option has to appear on that page, at the moment the address is collected, not only in a later email.
5. Open your last marketing email on the phone. Find the unsubscribe link and the postal address. Tap the link and count the steps. One page, no login, no fee.
6. Find the stop list. Somewhere in your email tool there should be a list of people who said no. If you can’t find it, nobody is checking it before a send.

If step 2 shows a pre-ticked box, change that first. It fails in Europe, and in the US the unsubscribe link does the work anyway.

Peeky reads the public pages of your site. For sign-up wording and the way out, the checks are UK-11 and US-14 in the Handbook, and EU-01 for trackers that fire before a yes.

Questions people ask

What is meant by opt-in and opt-out?

Opt-in means nothing happens until the person says yes: an empty box they tick, a button they press. Opt-out means it happens by default and the person has to say stop. The EU and UK ask for opt-in before marketing email to individuals; the ICO says you must not send marketing emails or texts to individuals without specific consent. The US federal rule works on opt-out.

What is the soft opt-in?

A UK rule that lets you email your own customers about similar products without a fresh yes. Regulation 22(3) sets three conditions: you got the address in the course of the sale or negotiations for the sale, you only market similar products or services, and you offered a simple, free way to refuse when you collected the address and in every message since. The ICO says it doesn't cover bought-in lists.

Is opt-out allowed for email marketing?

In the US, yes. The FTC's guide to the CAN-SPAM Act asks for a working opt-out and a postal address, and says you don't need to get members' consent to send them marketing emails. In the EU and UK, an email to an individual needs consent first unless the UK soft opt-in applies. A pre-ticked box doesn't count anywhere in Europe.

Is opt-in or opt-out better?

For a company that sells into both Europe and the US, opt-in is the simpler default, because a list built on a clear yes works under every rule here, while a list built on silence works under only one. The EDPB's consent guidelines say pre-ticked opt-in boxes are invalid under the GDPR and that silence or inactivity can't count as a choice.

How quickly do I have to honour an unsubscribe?

Under the CAN-SPAM Act, within 10 business days, and the opt-out link has to keep working for at least 30 days after you send. The UK rule asks for a chance to opt out in every message and a valid address for stopping them. Neither lets you charge a fee or ask for more than an email address.