Marketing consent and how to record it so you can prove it

Aug 29
3 min read

Updated: 5 days ago

Introduction

A business has a mailing list of four thousand addresses collected over eight years from a website form, business cards, a competition, an event, and a list somebody compiled from public sources. It sends a monthly newsletter to all of them.

Asked to demonstrate that each person consented, it can evidence almost none of it. Consent that cannot be shown is generally treated as absent, the list contains several categories that were never lawful to add, and the whole asset is considerably less usable than it appears. A large list you cannot lawfully email is a liability rather than an asset.

1. Marketing consent and how to record it are inseparable

The evidential requirement.

Most frameworks require you to demonstrate consent, not merely to have obtained it. A list without records of who agreed to what and when is a list you cannot rely on.

2. Record the specifics at the moment of collection

Four pieces of information.

Who consented, when, what they were told, and how they indicated agreement. Systems that capture the timestamp, the form wording and the source automatically are what make this practical at any scale. Doing it manually works for a hundred contacts and fails at a thousand.

3. Understand that consent must be a positive action

Pre-ticked boxes do not work.

An unticked box the person deliberately ticks, or an equivalent clear affirmative step. Consent bundled into terms and conditions, or implied from inaction, generally does not meet the standard. Silence and inactivity are specifically excluded in most frameworks.

4. Keep it separate from other agreements

Freely given means unbundled.

Consent to marketing should not be a condition of buying something or of using a service. Where somebody has to agree in order to complete a purchase, the consent is not freely given.

5. Be specific about what they agreed to

Granularity matters.

Email, telephone, post and text are different channels, and marketing from you is different from marketing from your partners. Broad consent to be contacted is weaker than specific consent to a named activity.

6. Check the rules for existing customers

Frequently more permissive.

Many jurisdictions allow marketing to existing customers about similar products without express consent, subject to conditions and an opt-out at every contact. Establish whether this applies to you, because it may cover a substantial part of your list.

7. Never buy or scrape a list

Both ineffective and unlawful in most places.

Purchased lists rarely carry valid consent for you specifically, and consent obtained by somebody else for their own purposes generally does not transfer. This is among the most commonly enforced areas.

8. Make withdrawal as easy as giving it

A requirement and a practical necessity.

An unsubscribe link in every message, honoured promptly, and a suppression list so somebody who opts out is not re-added from another source. Re-adding an unsubscribed contact is a frequent and avoidable failure.

9. Clean the list rather than defending it

The practical remedy.

Where consent cannot be evidenced for part of a list, a re-permission campaign or simply removing those contacts is better than continuing. A smaller list you can rely on is worth more than a large one you cannot.

Keep the record for as long as you rely on the consent, and review the list periodically. Contacts who have not engaged in several years are unlikely to be an asset and may represent consent that has grown stale, and removing them improves both compliance and deliverability.

Conclusion

Treat the record as part of the consent, because unevidenced consent is treated as none.

Capture who consented, when, to what and how at the moment of collection, require a positive affirmative action rather than a pre-ticked box, keep marketing consent unbundled from purchase terms, be specific about channels and about who may contact them, check whether existing-customer provisions apply in your jurisdiction, never buy or scrape lists, make withdrawal simple and maintain a suppression list, and clean the list rather than defending contacts you cannot evidence.