What’s the risk of unverified consent data imports?

Say you've got a CSV from a data broker, a list of 50,000 contacts that fits your target demographic perfectly. It's tempting. But importing that list without verified consent is one of the fastest ways to hurt both your deliverability and your legal standing at the same time.

Here's what you're actually inheriting when you import unverified data.

The compliance side. Regulations like GDPR require that you can prove consent. Not just claim it. If you import a list and someone asks how you got their data, "we bought it from a vendor" is not a lawful basis for processing. If regulators come knocking, you need documentation showing when consent was collected, how it was worded, and what the subscriber agreed to receive. That documentation lives with the original collector, not you, and vendors rarely hand it over in a format that actually holds up.

The deliverability side. Purchased or unverified lists tend to carry a specific kind of damage. Spam traps are common because old or scraped addresses eventually get recycled into traps by blocklist operators. Invalid addresses pile up and drive your bounce rate over the edge. And even the "real" addresses on that list never opted in to hear from you, so complaint rates tend to spike fast. The damage to your sender reputation can take months to undo (of course, that's assuming your ESP doesn't just suspend your account first).

Questions worth asking the vendor before you touch that list.

• How was consent collected, and can you provide documentation per contact?
• What was the exact opt-in language subscribers saw?
• When was each address last verified or engaged with?
• Has this list been sold or shared with other buyers before you?
• What is your process if a subscriber disputes consent?
• Can you provide a sample with timestamps and source URLs for the consent events?

If the vendor can't answer those questions clearly, that tells you everything you need to know about the list's quality. The temporary bump in list size is not worth a permanent dent in your sending reputation, and it's definitely not worth a regulatory fine.

Before you import anything, it's worth running it through a proof-of-consent check to understand what you actually have. If your list feels uncertain, we clean them at RME and flag what's safe to send to. Take a look at RME Clean before you hit import.