Marketing Consent

Sending one more email costs essentially nothing. A list with a hundred thousand addresses sends a hundred thousand messages, and if a handful of people click, it still beats paying for the same attention. Text messages run to a fraction of a cent each. With the arithmetic shaped that way, lists kept growing and so did send volume.

The same arithmetic piled up in the other direction for the people receiving it. One price enquiry turns into a weekly discount text. A phone number given to one tutoring center starts collecting ads from others. Look for the off switch and there's no unsubscribe number, or the number rings through to a recorded message and hangs up.

So the rule attached itself to the act of sending. Where GDPR and a national privacy statute like Korea's Personal Information Protection Act (PIPA) govern how data is collected and used in general, this one grabs the moment a message goes out and fines the sends that had no permission behind them.

What changed is the order of events. The old default was to send first and drop whoever objected. The new one is to send only to people who said yes. Collecting that yes in advance is called opt-in; the reverse, where messages flow until someone objects, is opt-out. Promotional email and texts sit on the opt-in side in the European Union, Canada and Korea, while commercial email in the United States still runs closer to opt-out.

Consent has to be collected before the first send, separately from every other agreement, and in a form you can produce later. Six places tend to catch teams out.

1. Where and how it's collected. A separate checkbox on the signup screen is the usual answer. A box that arrives pre-ticked doesn't count, and neither does burying the permission inside acceptance of the terms of service. Signup has to complete for someone who leaves the box empty.
2. What the person is agreeing to. Name who sends, what gets sent, and through which channel. Channels count separately — permission for email is not permission to text.
3. Records. Store who agreed, when, on which screen, and to what. The burden of proving consent falls on the sender, so without the record the claim doesn't stand.
4. Labels on the way out. Many regimes require the sender's identity and a working unsubscribe method in every message, and some add rules of their own: Korea, for instance, wants an ad marker in the subject line and separate permission to text between 9pm and 8am.
5. Withdrawal has to be easier than signing up. One link should finish it, with no second login and no screen asking why. Confirm once it's done.
6. Old consent gets refreshed. Korean rules ask senders to check every two years whether the person still wants the messages.

The principle running through all six is consent — one of the legal bases for handling personal data, where you ask permission first and stay inside what was asked. That makes it valid only as far as it reached. Permission collected to send product news doesn't cover a partner's advertising.

Two places, really: where the list is built and where the messages leave.

The building side is screen design. Every screen that takes an email address or a phone number — signup, checkout, a gated download — needs a decision about where the permission sits and how it reads. Shrinking the line or gluing it to a required field lifts the opt-in rate and leaves you with a list that's large on paper and unusable in practice.

The sending side is the filter that runs before the send button. CRM marketing, the work of messaging existing customers to bring them back, always includes a step that narrows the list to people who agreed. Messages a contract requires — maintenance notices, failed payments — go out regardless, so it's safer to route the two kinds through entirely separate paths in the sending tool.

A third situation comes up whenever a list arrives from outside: business cards from an event, a partner's list, the customer records of a company you acquired. Consent belongs to the company that collected it and the scope it described, so it doesn't travel with the file. Send promotions to an inherited list and the violations add up one address at a time.

"Of the 80,000 records on this list, 23,000 have marketing consent."

Under a quarter of the list is reachable, and sending to the rest creates a problem per message.

"This is a service notice, not a promotion, so we can send it to everyone."

The content is limited to what the contract requires, so consent doesn't gate it.

"Turn off the default on that checkbox in the signup screen."

Consent captured from a pre-ticked box has no effect, so the screen needs fixing.

Pagedeck ran into this while preparing an email inviting free users to upgrade. The list held 120,000 records, but the marketing permission had only appeared on the signup screen a year earlier, so anyone from before that had never agreed. Ravi filtered the list by consent date and found 31,000 reachable addresses.

Noa rebuilt the screen, lifting the permission out from under the terms into a line of its own and spelling out what would be sent. The remaining 90,000 got a single email asking for permission and nothing else. Only 4,000 came back, but what was left was a list the team could actually use.

The most common misreading is that agreeing to data collection at signup covers promotions too. Several checkboxes on one screen blur together in memory, so the assumption is understandable. Consent, though, splits by purpose. An address collected to run someone's account covers maintenance notices and failed-payment alerts; a discount announcement is a different purpose and needs its own permission. Blur that line and the newsletter becomes the risk. A message about how to use the product reads as a notice until a line about this week's discount goes in at the end, and then it's a promotion sent to everyone who never agreed.

Assuming an unsubscribe link is enough runs a close second. That link sits at the bottom of every email from every overseas service, so it looks like the whole of the rule. The regimes differ: commercial email in the United States leans on letting people object after the fact, while promotional email and texts in the European Union, Canada and Korea need agreement beforehand. Supply the link, send without consent, and the send itself is the violation.