Is consent a one-time thing?

Someone subscribed to your list two years ago. They haven't opened anything in months. Is your permission to email them still valid? That depends on a few things, and the answer isn't always yes.

Consent is not a one-time checkbox you can tick and forget. It's more like an ongoing agreement. The person who opted in two years ago consented to receive emails from you under the conditions that existed at that time. If those conditions change significantly, your original consent may no longer cover what you're doing now.

When consent expires or weakens

Under GDPR, consent must be as easy to withdraw as it was to give. That means a visible, functional unsubscribe link in every email. But beyond withdrawal, there are situations where you may need fresh consent entirely. If you significantly change what you're doing with someone's data, or start using it for a purpose they didn't originally agree to, you need to get new consent. A subscribe form that said "get our monthly newsletter" doesn't automatically cover a daily promotional email cadence you launched later.

Some regulators and legal advisors suggest refreshing consent every one to two years for inactive subscribers, though GDPR doesn't specify a hard deadline. The more practical test is this: would the person who opted in still recognise what they signed up for? If not, it's worth a re-confirmation.

Dormant subscribers are a real grey area

Someone who hasn't opened, clicked, or interacted with your emails in 12 to 18 months is a consent risk and a deliverability risk at the same time. They're probably not going to complain, but if they eventually hit "spam" because they forgot who you are, that complaint counts against you. Sending a re-confirmation email before removing them is both the legally cautious and deliverability-smart move.

CAN-SPAM doesn't require the same kind of explicit consent that GDPR does (opt-out rather than opt-in is the baseline), but it does require you to honour unsubscribes within 10 business days. Canada's CASL is stricter: express consent expires after two years if the subscriber hasn't engaged, and implied consent has its own time limits. So your obligations really do depend on where your subscribers are located.

Still the practical takeaway: treat consent as a living record, not a historical event. Log when and how someone subscribed, what they agreed to, and when they last engaged. If you're not doing that yet, that's the place to start.

Not sure if your current list is still in good shape? We can help you clean and validate it, or if you've got a specific compliance question, our SOS hotline is free.