Consent that survives an audit

An audit of marketing consent is not really a test of whether people consented. It is a test of whether you can show it, on a specific date, for a specific person, without asking four systems and reconciling the answers by hand. Most operators can eventually produce the evidence. The problem is that eventually takes three weeks and reads like an argument.

The order the questions come in

We have sat through enough of these to say the sequence barely varies. It goes: did this person consent, where did it come from, what did it cover, and what happened when they objected. Each question maps onto one field, and if the field is missing the answer becomes a story.

State is not enough

A flag saying marketing_opt_in = true is not evidence of anything. It records a conclusion without the reasoning. The minimum useful record has four parts: the state, where the consent was captured, when it was captured, and a pointer to the artefact that proves it. The pointer matters more than people expect, because it is what turns your assertion into something a third party can check.

The migration that destroys the evidence

The single most common way a consent history is ruined is a platform migration that stamps every imported row with the date of the import. It produces a clean dataset in which every one of your players consented on the same Tuesday in March, which is both obviously false and impossible to unwind.

Import the dates you have. Where a row has no date and no source, load it as unevidenced rather than as granted, suppress it from sending, and decide separately whether to re-permission those people. A smaller list you can defend is worth more than a larger one you cannot.

Keep the withdrawal next to the grant

There is an instinct to delete a record when somebody opts out. Resist it. An append-only history that shows the grant, the objection and the second the objection took effect is far more convincing than a database in which the person simply is not there. Deletion also removes your only proof that you stopped in time.

Scope, when one group is six brands

Consent given to one brand rarely covers the others, and an authority will ask about this specifically in a group structure. Record which brands each consent covers, apply an opt-out across every brand that shared the record, and be able to say which of the six a given message went out under.

A quick self test

• Pick a number at random from last year and produce its consent state as of that date
• Name the mechanism that captured it and point at the artefact
• Say which brands it covered and which message classes it allowed
• Show the last message sent to it and confirm nothing followed a withdrawal

If that takes longer than an afternoon, it is worth fixing before somebody external asks rather than after.