Can customers check out without agreeing to marketing?

Make refusal a working route

The decision for the owner is specific: can this checkout change be accepted when a customer declines marketing? Ask for a completed test order, a service confirmation and the resulting mailing-list status. A checkbox that looks optional is insufficient if payment validation, an account-registration screen or a later integration still requires agreement. Keep the review focused on the existing purchase journey; replacing the commerce platform is rarely the first question to answer.

PCPD case 2024C06 describes a bedding retailer whose checkout required shoppers to tick a direct-marketing consent box before payment could complete. Following PCPD advice, the retailer changed the page to allow a choice. The case explains that making refusal impracticable through bundled consent may amount to unfair collection. This is a published regulatory example, not an Astera client result; it does not establish a penalty or certify any other checkout.

Separate order service from promotion

List what the shop needs to fulfil an order, such as a delivery address and an email for order updates, separately from permission to send promotions. Where order terms need acknowledgement, give them their own control. Do not make a single required box cover order terms, a privacy notice and promotional use. Review both language versions in the actual mobile layout so that optional wording is visible before the customer acts.

For a modest maintenance budget, consider an optional, initially unticked marketing box on checkout. Another option is a separate invitation after the purchase, provided it cannot delay the receipt or order confirmation. If the current integration cannot reliably preserve a refusal, pause new marketing enrolment from checkout while the defect is fixed. These are implementation choices, not a complete statement of direct-marketing law: have the responsible privacy adviser check the notice, covered data, purposes and channels for the shop’s actual use.

Test both outcomes through the whole journey

Use synthetic customers, an authorised test checkout and a mail sandbox so that no real subscriber receives a test campaign. Run the matrix in English and Traditional Chinese, on the mobile and desktop routes the shop supports. Include guest and account checkout where both exist. Keep the basket, delivery option and test payment conditions equivalent between accept and refuse cases; otherwise a delivery or payment error can be mistaken for a consent defect.

Record actual results and evidence beside each case. These are proposed tests, not measured shop performance.

Follow the choice into the mailing list

Ask the developer to demonstrate the submitted choice, the stored record and the destination subscriber status for the same synthetic customer. Record the test identifier, time, language, notice version, selected channels and final choice, with access and retention appropriate to the evidence. Distinguish a pending subscription from an active one if a confirmation step exists. A successful integration response only proves that a request was accepted; inspect whether promotional automations actually exclude refused or suppressed contacts.

For returning customers, do not leave the meaning of an unticked box for the developer to guess. Ask the person responsible for privacy to specify how the displayed choice relates to existing preferences, then turn that decision into explicit interface wording and test cases. This checklist does not determine whether earlier consent remains valid. Provide a clear route to manage preferences. As an additional integration test, create a synthetic unsubscribe event followed by delivery of an older queued opt-in; set the expected result to remain unsubscribed and inspect the destination record. Have the developer demonstrate event ordering rather than relying on the order in which messages arrive. Keep service confirmations separate from promotional automation so that the test customer still receives the receipt.

Turn the result into a small change request

Give the person maintaining the shop a short change request containing the current blocking step, the approved bilingual wording and this matrix with space for evidence. Assign the owner of the mailing-list mapping as well as the checkout owner. Accept the change only after refusal completes a purchase and remains excluded from new marketing enrolment through retries and synchronisation. If a row fails, record the defect and retest the affected journey after repair. This acceptance exercise covers the consent flow; wider collection, retention and access requirements belong in a separate privacy review.