Email Consent Record

Definition

A consent record is the evidence that a subscriber has given valid, informed, and freely given consent to receive email marketing communications. Under the GDPR, consent must be "a clear affirmative act" and the controller bears the burden of proving that consent was obtained. A proper consent record captures all the information needed to demonstrate compliance: the exact timestamp of the opt-in (including timezone), the IP address of the subscriber at the time of opt-in, the method used (web form, in-store terminal, third-party partner), the exact wording of the consent statement shown, and the URL or location where consent was obtained.

The components of a valid consent record matter because incomplete records can render consent indefensible. A record that shows only "subscriber opted in on 2024-01-15" without the specific wording shown or the IP address provides limited evidence of valid consent. If a regulator investigates and the subscriber claims they did not understand what they were consenting to, the consent record is the primary evidence. The ICO has emphasised that organisations should be able to "demonstrate that consent was obtained, what the individual was told, and what they consented to."

Consent record retention intersects with other data protection obligations. Consent records must be kept for as long as processing relies on that consent. If a subscriber unsubscribes, the consent record may still need to be retained to demonstrate that marketing was sent with valid consent during the period it was active. Typical practice is to retain consent records for the duration of the subscriber relationship plus 1-3 years after unsubscription. Different ESPs handle consent record-keeping differently: some automatically log consent metadata, others require manual configuration of consent tracking fields.

Best Practices

Capture consent metadata automatically at the point of opt-in. Your sign-up form should automatically log: the precise timestamp (in UTC and local time), the subscriber's IP address, the full URL of the sign-up page, any pre-checked or unchecked boxes, and the exact text of the consent statement. Manual entry of this data creates errors; automated capture is essential for audit-ready records.

Store consent records separately from subscriber profile data. Consent records should be stored in an append-only log that cannot be modified or deleted by normal data operations. This protects the integrity of the evidence. If a subscriber requests data deletion, the consent record for the period when they were subscribed should be retained in this separate store for legal record purposes.

Include version tracking for consent statements in your records. Consent wording changes over time as privacy practices evolve. Your record should indicate which version of the consent statement the subscriber saw at the time of opt-in. Maintain an archive of all consent statement versions with dates. This is particularly important if you run multi-jurisdiction programmes where different consent statements may apply.

Implement consent renewal workflows for older records with insufficient metadata. Subscribers who signed up before better consent recording was implemented may have records that lack IP addresses, timestamps, or consent wording. These legacy records are vulnerable to regulatory challenge. Run a consent renewal campaign that asks these subscribers to reconfirm their consent with proper metadata capture.

Audit consent records quarterly for completeness and validity. Run a sample-based audit: select 100 recent opt-in records and verify that each contains timestamp, IP address, consent wording version, and sign-up method. Document the audit results and any corrective actions. A regular audit demonstrates a culture of accountability that regulators view favourably.