Definition
A consent record is the evidence that a subscriber has given valid, informed, and freely given consent to receive email marketing communications. Under the GDPR, consent must be "a clear affirmative act" and the controller bears the burden of proving that consent was obtained. A proper consent record captures all the information needed to demonstrate compliance: the exact timestamp of the opt-in (including timezone), the IP address of the subscriber at the time of opt-in, the method used (web form, in-store terminal, third-party partner), the exact wording of the consent statement shown, and the URL or location where consent was obtained.
The components of a valid consent record matter because incomplete records can render consent indefensible. A record that shows only "subscriber opted in on 2024-01-15" without the specific wording shown or the IP address provides limited evidence of valid consent. If a regulator investigates and the subscriber claims they did not understand what they were consenting to, the consent record is the primary evidence. The ICO has emphasised that organisations should be able to "demonstrate that consent was obtained, what the individual was told, and what they consented to."
Consent record retention intersects with other data protection obligations. Consent records must be kept for as long as processing relies on that consent. If a subscriber unsubscribes, the consent record may still need to be retained to demonstrate that marketing was sent with valid consent during the period it was active. Typical practice is to retain consent records for the duration of the subscriber relationship plus 1-3 years after unsubscription. Different ESPs handle consent record-keeping differently: some automatically log consent metadata, others require manual configuration of consent tracking fields.
Best Practices
Capture consent metadata automatically at the point of opt-in. Your sign-up form should automatically log: the precise timestamp (in UTC and local time), the subscriber's IP address, the full URL of the sign-up page, any pre-checked or unchecked boxes, and the exact text of the consent statement. Manual entry of this data creates errors; automated capture is essential for audit-ready records.
Store consent records separately from subscriber profile data. Consent records should be stored in an append-only log that cannot be modified or deleted by normal data operations. This protects the integrity of the evidence. If a subscriber requests data deletion, the consent record for the period when they were subscribed should be retained in this separate store for legal record purposes.
Include version tracking for consent statements in your records. Consent wording changes over time as privacy practices evolve. Your record should indicate which version of the consent statement the subscriber saw at the time of opt-in. Maintain an archive of all consent statement versions with dates. This is particularly important if you run multi-jurisdiction programmes where different consent statements may apply.
Implement consent renewal workflows for older records with insufficient metadata. Subscribers who signed up before better consent recording was implemented may have records that lack IP addresses, timestamps, or consent wording. These legacy records are vulnerable to regulatory challenge. Run a consent renewal campaign that asks these subscribers to reconfirm their consent with proper metadata capture.
Audit consent records quarterly for completeness and validity. Run a sample-based audit: select 100 recent opt-in records and verify that each contains timestamp, IP address, consent wording version, and sign-up method. Document the audit results and any corrective actions. A regular audit demonstrates a culture of accountability that regulators view favourably.
Related Glossary Terms
Australia Spam Act
Australia's Spam Act 2003 regulates commercial electronic messages including email. It requires consent, functional unsubscribe mechanisms within 5 working days, and sender identification. Penalties reach AUD $2.22 million per day.
Email CASL
Canada's Anti-Spam Legislation requirements for commercial electronic messages, including consent types, record-keeping, and penalties up to $10 million per violation.
Email CCPA
California Consumer Privacy Act requirements for email marketing, including consumer rights to access, delete, and opt out of data collection and sale.
Email Data Portability
Data portability under GDPR Article 20 gives subscribers the right to receive their email marketing data in a machine-readable format and transfer it to another provider. Common export formats are CSV and JSON.
Email Data Retention
Email data retention policies govern how long subscriber data, activity logs, consent records, and campaign data are kept. GDPR requires data not be kept longer than necessary for the processing purpose.
Email Encryption
Email encryption uses TLS for transit security and end-to-end methods like PGP, with compliance requirements for HIPAA, GDPR, and impacts on marketing email tracking.
Frequently Asked Questions
At minimum: the exact timestamp of the opt-in (including timezone), the subscriber's IP address, the precise wording of the consent statement shown, the method of opt-in (web form, API, in-person), and the URL or location where consent was obtained. Additional useful fields include device type, browser user agent, and any consent management platform (CMP) identifiers.
Consent records should be retained for as long as processing relies on that consent plus a reasonable period after to demonstrate historic compliance. Standard practice is the duration of the subscriber relationship plus 1-3 years. Some legal counsel recommend retaining consent records for up to 6 years after the end of processing to align with general statute of limitations periods.
Yes, significantly. Some ESPs automatically capture consent metadata with every list addition. Others only record the date of sign-up and require manual configuration to capture additional metadata. When evaluating ESPs, assess their consent record-keeping capabilities, including whether they provide immutable audit logs and support for custom consent metadata fields.
Consent records should be immutable once created. They are evidence of what happened at a specific point in time. If a subscriber later renews consent or updates preferences, that should be a new consent record rather than a modification of the original. An append-only consent log provides the strongest evidentiary value.
An incomplete or missing consent record means you cannot demonstrate that valid consent was obtained. If a regulator investigates, the absence of a consent record creates a presumption that consent was not properly obtained. This can result in fines, enforcement action, and requirements to cease processing data for the affected subscribers. Regular auditing and consent renewal for legacy records mitigates this risk.