Removing the Token of Trust consent checkbox

Here’s the checkbox we’re talking about:

If you are subject to CCPA (you sell to customers in California) or GDPR (you sell to customers in the EU) we recommend that you leave the consent checkbox in place as we believe it is required by law. Beyond the legal benefits, we believe from a UX perspective it is better to explicitly require that the customer read and agree to this than that they be surprised when they get the Token of Trust verification popup.

If you believe you’ve done an adequate job of informing the customer about Token of Trust and its use you may still want to remove the checkbox. We are not lawyers and cannot recommend specific terms of service to cover your use of Token of Trust. You should consult with your legal team but this is a good starting place:

What should I add to our Terms of Service to allow us to remove the checkbox

A. Identity Verification Through Token of Trust

Company uses Token of Trust to verify “Personal Information” (defined below) that you provide when you use or register for the Service, subscribe to notifications, post on the Service, participate in promotional activities, or communicate or transact through the Service. By agreeing to these Terms of Service you agree that we may provide “Personal Information” to Token of Trust. 

Information that Company may collect and provide to Token of Trust may include: (1) personally identifiable information, which is information that identifies you personally, such as your first and last name, date of birth, e-mail address, phone number, address, order number, and full payment account number ( “Personal Information” ); and (2) demographic information, such as your gender, age, zip code, interests, and recent and upcoming purchases (“ Demographic Information ”). Except to the extent required by applicable law, Demographic Information is “non-Personal Information” (i.e., data that is not Personal Information under this Privacy Policy). In addition, Personal Information, including, without limitation, once “de-identified” (i.e., the removal or modification of the personally identifiable elements, or the extraction of non-personally identifiable elements) is also non-Personal Information and may be used and shared without obligation to you, except as prohibited by applicable law.