Consent

Campaigns emails only people who agreed to get your marketing email, and never anyone on the suppression list. This is the same for every company that uses Campaigns. The Consent page (owners and admins) shows who can be emailed, records consent, imports proof, sends Ask for Permission, looks up any address, and handles privacy requests. Its counts (can be emailed, waiting to confirm, and withdrew) and What Your Team Confirmed, every attestation with who and when, come from campaigns.consent.info, which AI agents may read too.

Who Can Be Emailed

An address can be emailed when it has active consent, and:

• it never bounced and was never marked as spam,
• it did not unsubscribe, and was not added to the suppression list by hand, unless the person confirmed by email again afterward,
• the person did not ask to be forgotten, unless they confirmed by email again afterward,
• and the record it came from does not have Email opt out turned on.

Consent is active when the person confirmed it by email (double opt-in), when you brought it in with proof, or when they said yes to Ask for Permission. Consent that is pending (a ticked box not yet confirmed) never lets anyone be emailed. A bounce or spam complaint is never lifted.

A Marketing Box on Your Forms

Add a field to a form in Forms with the type Yes or no and Used as: Marketing email consent. Its label is the exact wording people agree to, for example "Yes, send me garden tips by email. I can unsubscribe at any time."

• The box always starts unticked, and it can never be required. People choose to tick it.
• When someone ticks it, Campaigns keeps a pending consent with the date and time, the form and page, the exact wording, and their IP address and browser.
• Campaigns then sends one confirmation email. It is plainly about confirming, with no offers or news, and it goes through your company's Email Delivery. It asks the person to select Confirm. If it was not them, they ignore it and nothing more is sent.
• When they confirm, the consent becomes active, with the time they confirmed. Ticking the box again within a day sends no second email.

A client portal or another system of yours can use the same step (the hook consent.capture), so its marketing box works the same way.

Importing Contacts with Proof

Import With Proof brings in a CSV file of contacts with the proof of consent for each person (campaigns.consent.import). Match the file's columns to:

• Email address and Name,
• Consent date: when they agreed,
• Where they agreed: the source or form,
• What they agreed to: the wording,
• IP address, if you know it,
• How they agreed: double opt-in, single opt-in, or existing customer.

A row has proof when it has a consent date, how they agreed, and where they agreed or the wording. Rows with proof get active consent. Rows without proof come in as contacts with no marketing consent: they can still get your other emails, such as invoices and replies, but never campaigns. Everyone with an email address becomes a CRM contact, unless a contact with that address is already there.

Before you import, you tick this box:

> I confirm that the consent proof in this file is accurate, and that each person's consent was collected lawfully.

Campaigns keeps who ticked it, when, these words, the file name, and how many rows had proof and how many did not. It shows under What Your Team Confirmed on the Consent page. Up to 2,000 rows at a time.

Recording Consent by Hand

Record Consent adds active consent for addresses you type, one per line (ann@example.com or Ann Lee <ann@example.com>), or for everyone in a saved filter or list (campaigns.consent.record). Choose how they agreed, say where they agreed, add the words they saw if you have them, and say whether they also agreed that you count opens and clicks. Then tick:

> I confirm that these people agreed to get marketing email from us, that the details above are accurate, and that their consent was collected lawfully.

That is kept with who and when, like an import. AI agents can never record consent. Selecting Add on the Consent Records page opens Record Consent too, and records added or imported on that page directly do not let anyone be emailed.

Ask for Permission

For contacts you have no proof for, Ask for Permission sends one email, once, asking if they want your marketing email (campaigns.permission.ask). It has one button, Yes, Email Me. Selecting it records active double opt-in consent, with the time, IP address, and browser. Anyone who does not select it stays without consent and gets no marketing email. Nobody gets Ask for Permission twice.

• Send it only to existing customers. You tick: "I confirm that every person this goes to is an existing customer of our company."
• The window shows this warning: Some countries, for example Canada and the countries of the European Union, restrict even this one email to people who have not agreed to marketing email. Sending it is your company's responsibility.
• It goes through your sending service, with your company name and postal address, so Campaigns Settings must be complete.
• People who already agreed, were asked before, or are on the suppression list are left out, and the window says how many.

Looking up an Address

Look Up shows whether an address can be emailed, and if not, why; every consent and withdrawal for it, with dates and where each came from; its suppressions; and the campaigns it was sent (campaigns.consent.status). Everyone in the workspace and AI agents can look up an address.

Withdrawing Consent

Withdraw Consent ends an address's consent straight away (campaigns.consent.withdraw). It adds its own dated withdrawal entry; the consent it ends is never changed or deleted, so the full history stays. AI agents may do this, since it only ever stops email.

Unsubscribes and the Suppression List

• Unsubscribe link: every campaign email has one, next to your company name and postal address, and mail apps show their own Unsubscribe button through the one-click headers (List-Unsubscribe and List-Unsubscribe-Post). The link opens a page with one Unsubscribe button, so link scanners cannot unsubscribe anyone by visiting it; the mail app's one-click unsubscribe works straight away. Either way, consent ends at once (a dated withdrawal) and the address goes on the suppression list as Unsubscribed, for good. Consent you record or import later does not lift it; only the person signing up again and confirming by email does.
• Bounces and spam complaints: when your sending service reports a permanent bounce or a spam complaint, the address goes on the suppression list for good. Unsubscribes your sending service reports are handled the same as the link.
• By hand: Add to Suppression List adds an address with an optional note (campaigns.suppress). AI agents may do this.

Every suppression is also a record in the Suppressions module, and Campaigns keeps its own permanent copy, so deleting a record never lifts a suppression.

Records Are Kept

Consent records are never deleted and never changed. A confirmation is the one change: a pending consent becomes active when the person confirms. Withdrawing adds its own entry. The Consent Records module shows a copy of every entry to see and export, and Campaigns keeps its own record of them, so turning the module off or deleting a record there does not change who can be emailed.

Privacy Requests: Erasing a Person

When a person asks you to forget them, Erase a Person removes them from Campaigns (campaigns.privacy.erase). Type their address twice. Campaigns removes their consent history, their suppressions, their confirmation emails, and the history that held them, and replaces their address on past campaigns. To honor their request never to be emailed, Campaigns keeps only the minimum needed: a fingerprint of the address (a one-way code made from the address and your company's own secret). The address cannot be read back from it, but Campaigns can tell if the same address turns up again, and leaves it out of every campaign. If the person later signs up again and confirms by email, they can be emailed again.

The Activity Log says that a person was erased and how many records were removed, never who. Erase them in CRM too (Privacy Requests), since each app erases its own records. Only owners and admins can erase, never an AI agent.