# WooCommerce Checkout Consent: The Checkbox That Blocks the Order

Source: https://consentpaladin.com/blog/2026-11-15-woocommerce-checkout-consent-checkbox.html

*A WooCommerce store adds a consent checkbox to checkout, puts it right above the place order button, and makes it required. The shopper has to tick it to buy. That checkbox is not consent. Consent has to be freely given, and a checkbox that blocks the order until it is ticked is not freely given. It is a toll, and the shopper who ticks it to get through has not consented to anything. They have paid the toll, and the store has recorded a consent that will not survive the first complaint.*

## The order and the marketing are two different consents

Checkout needs two things that look like one: the shopper's agreement to the terms of the sale, and the shopper's consent to marketing. The terms are part of the contract. The shopper has to agree to them to buy, and that agreement is not GDPR consent, it is the contract itself. The marketing opt-in is GDPR consent, and it has to be freely given, which means the shopper can buy without ticking it. The stores that get this wrong put both in one checkbox, or make the marketing box required, or hide the marketing opt-in inside the terms. The checkbox that blocks the order is the terms checkbox doing a job it was never meant to do, and the marketing consent recorded behind it is invalid.

The WooCommerce checkout documentation describes the terms checkbox as a requirement for placing the order, and that is correct for the terms. The marketing opt-in belongs next to it, unticked by default, clearly labelled as marketing, and optional. A pre-ticked marketing box is not consent either: the EDPB has been clear since the Planet49 ruling that pre-ticked boxes do not constitute valid consent, because consent has to be an active choice. The correct shape is two boxes: terms, required, for the contract; marketing, unticked, optional, for consent. The shopper who ticks only the terms buys the product and gets no marketing. The shopper who ticks both buys the product and gets the emails. Both are valid, because both were freely chosen.

## The checkbox has to work with the Consent API

The checkbox is not just a form field. It has to write to the WordPress Consent API, so the CMP and the other plugins know what the shopper chose, and it has to do it before the order completes, not after. A checkbox that only shows on the page and never records the choice anywhere is a decoration, and the marketing emails that follow it have no basis. The WordPress Consent API exists so that the consent state is available to every plugin that needs it, and the checkout checkbox that does not use it is a checkbox that only the checkout knows about. [The WP Consent API post covers the translator side of this](https://consentpaladin.com/blog/2026-11-13-wordpress-wp-consent-api-woocommerce-checkout.md): the API is the translator the banner needs, and the checkout checkbox is the other half of the same translation. [The order emails post covers what happens after checkout](https://consentpaladin.com/blog/2026-11-14-woocommerce-order-emails-pixels-after-consent.md): the pixels that fire after consent, and the emails that should only fire when the marketing box was actually ticked.

## Test it by not ticking the box

Place a test order and leave the marketing box unticked. If the order completes, the box is optional and the shape is right. If the order is blocked, the box is required and the consent is invalid. Then check the marketing list: the test customer should not be on it. If they are, the checkbox is recording consent it never received, and the store is emailing people who did not agree to be emailed. The test takes five minutes and it is the test every shopper runs without knowing it, every time they buy without ticking the box. Run it after every checkout change, because the checkbox gets moved, relabelled, and made required by the next person who edits the checkout, and the consent it records does not survive the change.

Keep the two boxes separate, keep the marketing box unticked, and keep the record of what the shopper actually chose. A consent record that says the shopper ticked a box they had to tick is a record that proves the opposite of what it claims.

## Frequently asked questions

### Can the marketing consent checkbox be required at checkout?

No. Consent has to be freely given, and a checkbox that blocks the order until it is ticked is not freely given. The terms checkbox is required because it is part of the contract. The marketing opt-in has to be optional, unticked by default, and separate from the terms.

### Is a pre-ticked marketing box valid consent?

No. The Planet49 ruling established that pre-ticked boxes do not constitute valid consent, because consent has to be an active choice. The marketing box must start unticked, and the shopper has to tick it themselves.

### Does the checkout checkbox need to use the WordPress Consent API?

Yes, if you want the choice to mean anything outside checkout. The Consent API makes the consent state available to the CMP and to other plugins. A checkbox that only shows on the page and never records the choice is decoration, and the marketing that follows it has no basis.

### How do I test the checkout consent checkbox?

Place a test order with the marketing box unticked. The order should complete, and the test customer should not be added to the marketing list. If the order is blocked, the box is required and the consent is invalid. If the customer is added anyway, the checkbox is recording consent it never received.