Setup checklist#
- ☐ Use an unchecked checkbox or a dedicated signup form; never pre-tick.
- ☐ Record timestamp, IP, source, and the exact wording shown at consent.
- ☐ Use double opt-in for marketing lists where feasible.
- ☐ Separate consent for different purposes (newsletter vs partner offers).
- ☐ Refresh consent for contacts older than two years with no engagement.
Audit checklist#
- ☐ Confirm you are not: bundling marketing consent into terms of service acceptance.
- ☐ Confirm you are not: losing consent records during a CRM migration.
Ongoing monitoring#
- ☐ Weekly: review provider dashboards (Postmaster Tools, SNDS) and bounce logs
- ☐ Monthly: re-run the setup verification after any vendor or DNS change
- ☐ Quarterly: full audit against this checklist
Frequently asked questions#
Is double opt-in required by law?
Not explicitly in most jurisdictions, but it is the easiest way to prove consent under GDPR and CASL and it improves list quality.