How to handle expired or outdated consent data?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
Consent can age out in a few different ways: the consent language you used no longer matches what you're actually doing, time-based validity periods have expired (like CASL's two-year implied consent window), or legal standards have changed since you collected it. When that happens, you have a few options. and continuing to send as if nothing changed isn't one of them.
When your consent language has changed significantly: If you've added new sending types, new data-sharing partners, or significantly expanded what you do with subscriber data since you collected consent, the original consent may not cover those new uses. The fix is a consent refresh campaign for the affected segment. re-confirm what they're agreeing to under the updated terms.
When consent has a time limit that's expired: Under CASL, implied consent from a purchase or business relationship expires after two years. After that, you need express consent to keep sending. Run an opt-in campaign before the expiry (not after. once it's expired, sending to ask them to re-consent is already a violation).
When records are incomplete or unverifiable: If you have subscribers whose consent history is unclear (old imports, acquired lists, migrated data), treat them as not consented until you can establish otherwise. Sending to contacts you can't demonstrate consent for is the riskiest category.
Practically: audit your list by signup date and source, and identify which segments have consent records that don't meet your current standards. Prioritize the highest-risk segments (EU/UK subscribers, oldest records, unknown sources) for re-confirmation or suppression.
For how long to keep consent records even after they expire, see that article next.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
