What’s the difference between subscriber data and consent metadata?

These two things live in your ESP alongside each other, but they serve completely different purposes. and they have different rules for how long to keep them and what to do with them when someone asks to be deleted.

Subscriber data is everything you know about the person: their email address, name, demographics, purchase history, preferences, engagement metrics. It's the operational data that powers segmentation, personalization, and targeting. It's also the data that gets deleted when someone exercises a right to erasure. because it's personal data about them.

Consent metadata is the record of the permission event: when they opted in, through what mechanism, what consent language they were shown, the IP address at signup, and (for double opt-in) the confirmation click. It's not primarily about who they are. It's about proving you had permission to send to them.

Why the distinction matters:

• When someone asks to be deleted, you delete subscriber data but can often retain a minimal consent record as evidence that the relationship existed and was legitimately established.
• When a consent record ages out or becomes questionable, you may need to re-confirm consent while still retaining the historical consent metadata for defense.
• If you migrate to a new ESP, subscriber data and consent metadata need to migrate together. or you lose the consent audit trail for your existing list.

The practical gap most programs have: they can pull up subscriber records easily but can't pull up the consent event that created the record. If your ESP can't show you when and how a specific subscriber opted in, with the form version they saw, you have subscriber data without consent metadata. That's a compliance risk.

See how to prove consent in an audit for what good consent metadata looks like in practice. See also how long to keep consent evidence.