A mailing list without consent tracking isn't an asset - it's a liability with a spreadsheet

Background

A mailing list gets talked about like a straightforward number - bigger is better, growth is progress. It isn't a number. It's four thousand individual legal relationships, each one either properly consented or not, and the difference only becomes visible the day someone complains, an auditor asks, or a regulator gets involved. By then it's too late to go back and work out who actually opted in.

The uncomfortable version of this: a list built by importing contacts from a CRM, buying a list, or "everyone who's ever emailed us" isn't a mailing list under UK PECR/GDPR rules. It's a list of people you haven't asked yet.

Setup

What a defensible record actually looks like

Every contact needs a recorded consent event with three specific things attached to it, not a general sense that they're "on the list":

• When - a timestamp, not "a while back."
• How - the exact mechanism: ticked a box on a named form, replied "yes" to a specific email, signed up at a specific event.
• For what - marketing emails specifically, not a blanket "contact me" that gets stretched to cover a use it was never collected for.

"Ticked a box on the signup form on 14 March, consenting to marketing emails" is defensible. "They've always been on the list" is not, and won't hold up if it's ever questioned. If your platform can't produce that record for an individual contact on request, that's a gap worth fixing before it's ever tested by a real complaint.

Double opt-in, and why the extra click matters

For anything genuinely marketing - not transactional - a confirmation click after signup is the difference between "someone typed an email address" (which might be a typo, or might be someone else's address entirely) and "that person actually wants this." Two things worth checking on the actual implementation, not just the policy:

• The confirmation email itself doesn't count as a marketing send it needs its own consent for - it's a one-time transactional message confirming the request, sent regardless of the eventual answer.
• An unconfirmed signup expires and gets deleted, rather than sitting indefinitely as a half-consented record nobody's cleaned up. A list of people who never confirmed is a liability with no upside - it can't be emailed, and it's still personal data sitting there with no basis for keeping it.

The soft opt-in exception, and where it stops

UK law allows emailing an existing customer about similar products without a fresh opt-in - a genuine exception, not a loophole to stretch:

• It applies to an actual completed transaction, not a lead who filled in a contact form, requested a quote, or attended a demo without buying anything.
• "Similar products" means genuinely similar to what they bought, not the whole catalogue. Emailing every customer about an unrelated product line on the strength of one past purchase is outside the exception, not inside it.
• It still needs an opt-out offered at the point of collection, and on every message - the exception removes the need for opt-in, not the need for an easy way out.

Unsubscribe as a legal requirement, not a courtesy

One-click unsubscribe, genuinely one click, not a login wall or a "tell us why you're leaving" form standing between the person and the exit. Since 2024, Gmail and Yahoo enforce this as a bulk-sender requirement, not just good practice:

• The unsubscribe has to actually work immediately, not queue a request that gets processed "within 10 working days" while more emails go out in the meantime.
• Get it wrong at scale and mail starts landing in spam wholesale, for every recipient, not just the one who complained - a deliverability problem that's far more expensive to fix than the unsubscribe link would have cost to build properly in the first place.

A sunset policy, worked example

Someone who hasn't opened an email in two years isn't an engaged subscriber sitting there waiting - they're a deliverability risk dragging down your sender reputation for everyone else on the list. A workable policy, as a concrete example rather than an abstract principle:

1. No opens in 6 months: move to a reduced-frequency segment.
2. No opens in 12 months: send one clearly-marked "still want to hear from us?" re-engagement email.
3. No response to that email within 30 days: suppress from future sends.
4. Review the suppressed list annually - genuinely delete records with no activity and no other basis for retention, rather than letting a suppression list grow forever as a second, forgotten mailing list.