Pre-ticked consent boxes: why consent should start at No
Consent controls that are already switched on when the screen loads.
What it is
A pre-ticked consent box is a checkbox or toggle that is already on when the customer first sees it, so doing nothing counts as saying yes. Press coverage of the RBI directions says consent must be explicit, and the Digital Personal Data Protection Act asks for consent that is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Check the official texts and dates for your situation.
What it looks like
On a fictional lender's application screen, a single box is already ticked: “I agree to the Terms, the Privacy Policy, sharing my data with partner companies, and promotional calls and messages.” The customer has agreed to four unrelated things without taking any action.
Why it matters
Consent given by default is not consent a customer has thought about. Bundling several purposes into one box makes it worse, because the customer cannot accept one and refuse the others.
How to avoid it
- Load every optional consent control switched off.
- Give each purpose its own control, with its own plain-language label.
- Do not use “by continuing you agree” wording as a substitute for a choice.
- Make withdrawing consent about as easy as giving it.
How it is tested
This one can be found on a single page. ConductLens reads the starting state of every consent control on a public page and flags any that are already on, with a dated screenshot as evidence. A person then confirms each candidate before it appears in a report.
Keep reading
- Basket sneaking: add-ons the customer never chose
- Confirm shaming: when saying no is made to feel wrong
- RBI's dark-pattern rules from 1 January 2027: a checklist
Sources
- Outlook Money: banks and NBFCs to face stricter oversight on dark patterns
- Moneylife: RBI cracks down on mis-selling, barring forced bundling and dark patterns
This guide is general information, not legal advice, and not an opinion on any institution's position. Requirements change: check the official RBI text for your entity category before relying on anything here.