In reply to Jeff Chandler.

As David Decker has hinted at, there's an EU directive which states that "the data subject [must have] unambiguously given his consent;" - so it would illegal on a site operating from any EU country, unless that criteria is met.