Consent and Suppression Across Regions
A company markets in the EU, UK, US, and Canada from one instance. Consent is captured via a single 'Opted In' boolean on the person record, set by a form checkbox with no record of what was consented to, when, or from where. A recent acquisition imported 200,000 records from a purchased list with the boolean defaulted to true. The EU team wants to email the acquired list; legal has flagged it. Preference center exists but only toggles the one boolean. The CRM sync writes opt-out back to the platform but not the reverse. Data retention is undefined; contacts from 2016 are still mailable.
1. Assess the risk and lay out the consent remediation.
Read the worked answer
This is a high-severity exposure on multiple axes.
The purchased list is the acute risk. Records imported from a bought list with consent defaulted to true are not validly consented under GDPR/UK GDPR/PECR or CASL. Emailing them is the violation, and the default-true boolean is the evidence that consent was fabricated. Immediate action: suppress the entire acquired cohort from all marketing sends pending review; do not email the EU subset.
The boolean is the structural risk. A single 'Opted In' flag cannot evidence lawful basis: no purpose, timestamp, source, or jurisdiction. Remediation:
- Introduce consent fields that capture basis (consent vs legitimate interest), purpose, source, timestamp, and jurisdiction per record.
- Re-permission where lawful basis is consent and evidence is missing - starting with EU/UK/CA, using a compliant re-permission campaign to those with a defensible prior relationship, not the purchased list.
- Suppress anything without a lawful basis until re-permissioned.
Preference center must expose granular purposes (product updates, events, research) and record each choice with timestamp and source.
Retention needs a defined policy; 2016 contacts with no engagement should be suppressed or deleted per policy.
The judgement: you stop the send first, then rebuild the consent data model. You never default consent to true.
2. The CRM sync writes opt-out one way only. Why does that matter and how do you fix it?
Read the worked answer
A one-way opt-out sync creates a split-brain consent state: a person can be unsubscribed in the platform but still appear mailable in the CRM, so any CRM-originated send (or a rep's manual email) violates their choice. Conversely, if the platform is the system of record for consent and the CRM can't see it, sales outreach bypasses suppression.
Fix:
- Make consent bidirectional and platform-authoritative (or explicitly CRM-authoritative - pick one and document it). The platform captures preference-center changes; those must write back to the CRM's consent fields promptly.
- Sync the granular consent fields, not just a boolean, so downstream systems know purpose and jurisdiction.
- Guard against sync loops and overwrites. Define precedence so a legitimate opt-out is never overwritten by a stale CRM value; treat opt-out as sticky.
- Suppress at send time from the authoritative record, and monitor sync failures - a silent sync break is a compliance incident waiting to happen.
The judgement: consent state must be consistent across every system that can contact the person, and opt-out must propagate both directions.