When a user is setting up their profile in my web app, I want them to act on 2 different email settings:
1) Permission to email when another user interacts with them (for example, sends them a message)
2) Permission to email about new promotions
Having a checkbox that defaults to unchecked seems like it would have a low percentage of opt-ins, but some laws (for example, the Canada anti-spam laws) require that this be opt-in. Requiring user interaction here seems logical.
What is the current accepted best practice for having users set their email permissions?