How long can you keep unengaged subscribers legally?

Here's a question that trips up a lot of senders: is keeping an unengaged subscriber on your list actually legal? The short answer is it depends, and the answer changes based on where your subscriber lives, not where you do.

No law gives you a fixed expiry date. GDPR doesn't say "delete after 12 months." CAN-SPAM doesn't either. What they do say, in different ways, is that you can only hold personal data for as long as there's a valid reason to hold it. When someone stops engaging entirely and you have no other relationship with them, that reason gets harder to justify.

In practice, most senders working under GDPR use 12 to 24 months of inactivity as their internal threshold. Some go as tight as 6 months. The logic is simple: if someone hasn't opened, clicked, or interacted with your emails in over a year, what's the legitimate purpose of keeping their data? If you can't answer that clearly, you probably shouldn't be keeping it.

But there's an important distinction here. "Legally allowed" and "deliverability smart" are two very different things. You might be technically within your rights to keep a three-year-old contact on your list. But sending to them is almost certainly hurting your sender reputation. Unengaged addresses attract spam complaints. Some of them turn into recycled spam traps. Mailbox providers like Gmail and Outlook actively use engagement signals to decide where your mail lands. Keeping ghosts on your list is a legal grey area and a deliverability problem at the same time.

Before you delete anyone, try a re-engagement campaign first. Send one or two emails specifically asking if they still want to hear from you. Make it easy to say yes or to opt out gracefully. If they don't respond to that, you have your answer, and removing them is both the legally cleaner and the deliverability-smarter move.

A simple framework that works for most senders:

• 6 to 12 months of inactivity: Flag as unengaged, reduce sending frequency or exclude from broadcasts.
• 12 months: Trigger a re-engagement campaign. Give them a clear chance to stay.
• No response after re-engagement: Suppress or delete. Document when and why you removed them.

If you're operating under GDPR, documenting your retention logic matters. You should be able to explain, if asked, why you held data for as long as you did. "We sent a re-engagement email at 12 months and removed non-responders at 14 months" is a defensible policy. "We just never got around to cleaning the list" is not.

If your list hasn't been cleaned in a while and you're not sure where to start, we can help with that. RME Clean runs your list through validation and hands you back clear files showing what to keep, what to monitor, and what to drop. Or if you'd rather talk it through first, our SOS hotline is free.