What is the difference between explicit and implied consent?

Explicit consent is actively given (checking a box, clicking confirm). Implied consent is assumed from a business relationship (existing customer). GDPR generally requires explicit consent for marketing, while CAN-SPAM allows implied consent with proper disclosures.

Does buying a product count as consent to receive marketing emails?

In some jurisdictions, existing customers can receive marketing under 'soft opt-in' rules if the products are similar and they can easily opt out. However, explicit consent at checkout is safer and clearer.

How long does consent last?

There is no fixed expiration, but consent can become stale. If a subscriber has not engaged in 12-24 months, consider running a re-permission campaign to confirm they still want to hear from you.

Back to Glossary

Compliance & Legal

Consent

Permission given by a subscriber to receive marketing emails from you.

Definition

In email marketing, consent is the permission a person gives to receive commercial emails from you. Consent can be explicit (actively opting in) or implied (through an existing business relationship), depending on the jurisdiction. Modern regulations like GDPR require explicit, informed consent for marketing communications.

Why It Matters

Consent is both a legal requirement and a best practice. Sending emails without consent violates laws like GDPR and CAN-SPAM, damages your reputation, and results in poor engagement. Permission-based email marketing consistently outperforms non-consented approaches.

How It Works

Consent is typically obtained through signup forms, checkout opt-ins, or account creation processes. For GDPR compliance, consent must be freely given, specific, informed, and unambiguous. This means clear language, no pre-checked boxes, and separate consent for different types of communication.

Best Practices

1Use clear, specific language about what subscribers are consenting to
2Do not use pre-checked opt-in boxes
3Document when, where, and how consent was obtained
4Make it easy to withdraw consent at any time
5Periodically re-confirm consent for long-term subscribers

Consent Type Table

Consent type	How it is collected	Marketing risk
Explicit consent	Subscriber actively checks a box or confirms by email	Lowest risk when language is clear and stored
Implied consent	Existing customer relationship or related transaction	Depends heavily on jurisdiction and message relevance
Soft opt-in	Customer is offered an easy opt-out while buying a similar product	Useful for customer marketing, but needs careful scope
No valid consent	Purchased lists, scraped contacts, or hidden opt-ins	High legal and deliverability risk

Consent Record Table

Field to store	Why it matters	Example
Timestamp	Shows when permission was given	2026-06-12 14:30 UTC
Source URL or form	Proves where consent happened	Pricing page newsletter form
Consent copy	Shows what the subscriber agreed to	"Send me product updates and marketing emails"
IP address or user agent	Helps investigate disputes or abuse	Browser and request metadata

Consent Maintenance Table

Situation	Consent concern	Recommended action
Subscriber inactive for 18 months	Permission may be stale	Send re-permission only where you still have valid permission to contact them; otherwise suppress
Product line changes	Original consent may not cover new topics	Ask for updated preferences before broad sends
Imported customer list	Consent evidence may be incomplete	Verify source and segment conservatively
User withdraws consent	Continued marketing becomes non-compliant	Unsubscribe immediately and retain suppression record