I'm under the impression this is not a CGI.pm limitation, but something the browser simply doesn't send in the POST request. You'll probably have to store the unchecked values somewhere so you can lookup against the complete list to see what wasn't sent.