Consent: what it means

In email marketing, consent is a person’s agreement to receive your emails and to have their contact details used for that purpose. Modern privacy laws set a high bar for it. Under India’s Digital Personal Data Protection Act, 2023, consent must be free, specific, informed, unconditional and unambiguous, given through a clear affirmative action, and limited to the data needed for the stated purpose. The GDPR in the EU uses similar language.

In practice, valid consent looks like an unticked checkbox or a sign-up form whose purpose is obvious, next to wording that says what you will send. It does not look like a pre-ticked box, a line buried in terms and conditions, or an assumption that buying something means agreeing to newsletters. Under the DPDP Act, consent must also be preceded by a notice explaining what data you collect and why, in clear and plain language.

Consent must be as easy to withdraw as it was to give. If someone signed up with one click, they should be able to leave with one click. Once consent is withdrawn, the DPDP Act requires you to stop processing that person’s data for the purpose within a reasonable time, unless the law requires you to keep it, and to make sure your processors stop too.

Consent is also specific to the purpose. Agreeing to receive order updates doesn’t mean agreeing to promotional emails, and agreeing to your newsletter doesn’t let you share the address with a partner. If you start a new type of email, check whether your original consent covers it. Recording the wording, date and source of each consent makes all of this provable later.