Preparing a Consent Flow for EU Launch

Your company is launching in the EU next quarter. The current signup flow (US-only until now) has a single "Create Account" button; account creation automatically enrolls users in marketing emails, third-party data sharing with two ad partners, and personalized-ads tracking, all described in a "By signing up, you agree to our Terms and Privacy Policy" line with links at the bottom of the form. Legal asks you to "just add a GDPR checkbox" and ship the same flow to the EU.

1. Explain specifically why "just add a checkbox" to the existing flow does not, on its own, satisfy GDPR's consent requirements.
2. Using the three privacy-by-design commitments from this subject, redesign the consent portion of this signup flow at a conceptual level (what changes, and why each change matters).
3. Is there a reason to consider changing the global (non-EU) flow to match, rather than maintaining two different signup experiences? Give the strongest argument for and against.