A checkbox is the weakest possible form of consent. It asks for a single binary decision about a policy that may be thousands of words long, and it records no evidence that the user read any of it.

Separate the decisions

The most common failure is bundling. Analytics, marketing and product improvement get one control, so declining any of them means declining all three. People accept the bundle rather than navigate the alternatives.

Splitting these into independent choices -- each off by default, each with a plain description of what it enables -- costs some conversion and produces agreement that means something.

Say what actually happens

The text beside the control should describe the data, not the policy. "Helps us improve search results" is a category. "Stores your recent searches and the pages you opened so we can rank results better" is information.

If retention is limited or the data is deleted on request, say so in the control itself rather than three policy pages away. Detail people will not read can only hurt you if it exists.

Make withdrawal as easy as agreeing

This is the asymmetry that draws regulatory attention. Granting consent takes one click; revoking it should not require an email. If you give people a control at all, give them one that both turns it on and turns it off.

For AI products, be specific about inputs

Products built on language models have an obligation that older analytics did not: be clear about whether user input is used for training, and for how long. "We may improve our services using your data" is not adequate for content that may include private information.