No pre-checked checkboxes or default opt-in for marketing

GDPR Art. 7(2) is explicit: 'the request for consent shall be presented in a manner which is clearly distinguishable from the other matters' and pre-ticked boxes do not constitute valid consent. The CJEU (Planet49 case, 2019) confirmed that pre-checked boxes are unlawful under ePrivacy Art. 13(2) for EU residents. Beyond EU law, a server-side handler that defaults marketingOptIn to true when the checkbox isn't submitted silently opts in users who never saw the checkbox — this is a dark pattern that generates high spam complaint rates and undermines any claimed consent basis under CAN-SPAM.

Default all marketing checkboxes to unchecked, both in the frontend component and in the server-side handler that receives the form submission.

// CORRECT — explicit unchecked default
<label>
  <input
    type="checkbox"
    name="marketing"
    defaultChecked={false}  {/* always explicit — never omit */}
  />
  Send me product updates and offers (optional)
</label>

// Server-side — never default to true
const marketingOptIn = formData.get('marketing') === 'on'  // false if unchecked
// WRONG: formData.get('marketing') ?? true  — defaults opted-in when field absent

Audit form state initialization in React Hook Form, Formik, or Zod parsers — any default: true on a marketing consent field is the same violation expressed differently.