Consent Management

Consent management is the process of collecting, recording, updating and honouring the consent people give for the use of their personal data, for example for marketing messages. Under Article 7 GDPR, a business must be able to demonstrate that consent was given, and withdrawing it must be as easy as giving it.

What is consent management?

Consent management covers everything that happens around a person’s consent: asking for it, recording it, respecting it in every campaign, and acting immediately when it is withdrawn. For customer messaging, that usually means knowing exactly who agreed to receive which kind of message, on which channel.

Under the GDPR and the UK GDPR, valid consent must be freely given, specific, informed and unambiguous, given by a clear affirmative action (Article 4(11)). Article 7 adds the conditions that matter most in practice:

  • Proof (Article 7(1)): the controller must be able to demonstrate that the person consented.
  • Clear request (Article 7(2)): if consent is part of a form that also covers other matters, it must be clearly distinguishable and in plain language.
  • Easy withdrawal (Article 7(3)): people can withdraw at any time, and withdrawing must be as easy as giving consent.
  • No bundling (Article 7(4)): consent is not freely given if a service is made conditional on consent that is not needed for it.

For email marketing, the double opt-in has become the safe standard in many markets: the person signs up and then confirms via a link, which proves that the address really belongs to them.

Why it matters: proof is on you

Consent only protects you if you can prove it. Good consent management records, for each contact:

  • Channel: WhatsApp, SMS, email or another channel
  • Purpose: newsletter, offers, service updates
  • When and how consent was given, for example via which form or keyword
  • When it was withdrawn, if it was

This matters for advice-heavy businesses in particular. Insurance brokers, for example, need consent and chat history on record.

The marketing rules add their own pressure. In the UK, the Privacy and Electronic Communications Regulations (PECR) require consent for most marketing emails and texts, and the ICO can take enforcement action against unsolicited marketing. In the US, marketing texts fall under the Telephone Consumer Protection Act (TCPA), which allows individuals to bring claims for unsolicited messages. In every case, if a complaint comes in, you have to show the consent.

There is also a business upside. Lists built on clear opt-ins contain people who actually want to hear from you. That means fewer complaints and blocks, which on channels like WhatsApp also protects your sender quality.

Example: a fashion retailer in Brighton

A fashion retailer in Brighton had three separate lists: newsletter subscribers in the email tool, a spreadsheet of WhatsApp numbers collected in store, and SMS contacts from an old loyalty scheme. Nobody knew for sure who had agreed to what, and unsubscribes in one tool were not reflected in the others.

The retailer moved everything into one central system. Each contact now shows which channels they have opted into and when. In-store sign-ups go through a short form; email subscribers confirm via double opt-in. When a customer replies STOP on WhatsApp, they are removed from WhatsApp campaigns straight away, and the team can see it on the contact. Before each broadcast, only contacts with a valid opt-in for that channel are selected.

Consent management with SendSeven

  • Consent per contact and channel: each contact has a subscriptions view showing what they have agreed to.
  • Unsubscribes handled centrally: STOP and START keywords are processed automatically on WhatsApp, SMS, Messenger, Instagram and Telegram, and marketing emails include one-click unsubscribe.
  • Double opt-in for email sign-ups.
  • Hosted in the EU (Frankfurt), encrypted in transit and at rest, with a DPA under Article 28.

For the legal basis of messages that do not need consent, see legitimate interests. The overall picture is in GDPR-compliant messaging.

This is general information, not legal advice. Check the details with your data protection lead or compliance consultant.