Email Consent Records: Keep the Permission, Purpose and Opt-Out Together
Keep email permission, purpose, evidence and opt-out state together so campaigns respect the latest applicable subscriber preferences.
TL;DR
- Record what a person agreed to, which address and channel it covers, and when and how the choice was made.
- Preserve the wording shown at the time rather than relying on the current version of a signup form.
- Make withdrawals update the actual sending eligibility, including queued campaigns and later imports.
- Determine the applicable marketing rules for your audience and jurisdiction; a database checkbox is not a legal assessment.
Treat permission as a record with context
A field named subscribed can be useful for sending logic, but it is a weak explanation of how someone joined an audience. It does not tell you what they were offered, which organization they expected to hear from or whether the address was entered by the person concerned.
Keep the event that created the permission alongside the current eligibility state. Record the address or contact identifier, the channel, the purpose, the form or process used and the time. Retain a version of the relevant wording so later changes do not rewrite the history.
Collect only the evidence your process needs and protect it appropriately. Full request bodies, unrelated profile information and secret tokens do not become useful merely because they are stored in a consent table. Define access and retention with the team responsible for privacy requirements.
Understand the rule you are implementing
Different jurisdictions and recipient categories can have different marketing requirements. This guide describes an implementation approach, not a determination that a particular campaign is lawful. Resolve the applicable requirements with a qualified adviser when needed.
For a UK example, the ICO's electronic-mail marketing guidance explains consent, relevant exceptions and the need for evidence of who agreed, when and how. It does not treat silence or a preselected box as affirmative consent. Do not generalize one exception to every address in a list.
Keep operational labels precise. A customer account, an email-verification event and permission to receive marketing are different records. Verifying that someone can receive a login code does not by itself establish what marketing they agreed to receive.
Store the event and the current state
| Record | Example of its purpose |
|---|---|
| Contact and address | Identifies the address covered by the choice |
| Organization and channel | Establishes who may send and by which method |
| Purpose or audience | Describes the messages the person expected |
| Wording version | Preserves what was presented when the choice was made |
| Event timestamp and source | Shows when and through which process the choice occurred |
| Withdrawal or suppression | Prevents later sends when eligibility has changed |
Use a history of events where that helps explain changes, with a clearly derived current state for sending. For example, an opt-in followed by an unsubscribe should leave the contact ineligible for the covered marketing stream. An old import must not overwrite that withdrawal simply because its file is newer.
Make a confirmation reply specific
If a process uses an email reply to record a choice, the request should identify the organization, channel and purpose clearly. A response such as “Yes, please send the monthly product newsletter from Example Company to this address” is easier to interpret than an unrelated “okay” in a long conversation.
This is an illustrative wording example, not a ready-made legal consent form. The request itself, the surrounding circumstances and the applicable rules still matter. Do not send unsolicited permission requests indiscriminately and assume the request falls outside marketing rules.
Record the relevant reply and request context through the approved process. Do not paste a full private conversation into a marketing database when a narrower, controlled record can establish the event.
Apply withdrawals to the sending system
A successful unsubscribe page should update the state that campaign workers actually consult. Test a contact who unsubscribes after a campaign is scheduled but before the worker sends. The later eligibility check should honor the applicable withdrawal.
The ICO's preference guidance discusses retaining limited suppression information to prevent unwanted recontact. Treat suppression and deletion requests according to their purpose and applicable obligations rather than erasing the only signal that stops a later import from reactivating the address.
Our suppression-list guide covers the operational side of imports and sending checks. Keep marketing eligibility distinct from essential service notifications whose basis and purpose must be assessed separately.
Test the lifecycle with a small controlled audience
Exercise signup, confirmation where used, withdrawal, reimport and a later intentional resubscription. Confirm that every step produces the expected state and that support can explain the result from the recorded evidence.
Test the negative cases too: a stale import, a duplicated event, a missing wording version and an unsubscribe arriving while a campaign is queued. These cases reveal whether the implementation respects the person's current choice.
Review the process when forms, brands, audiences or email providers change. Consent records are useful when they connect a real choice to the actual sending decision. The goal is an explainable, maintainable system that respects the scope of that choice.