What are the issues with ESPs adding addresses to accounts and marketing campaigns without consent?
Matthew Whittaker
Co-founder & CTO, Suped
Published 7 May 2025
Updated 19 Aug 2025
7 min read
Sending emails to individuals who haven't explicitly given consent is a critical issue in email marketing, carrying significant risks for both the sender and the Email Service Provider (ESP). I recently encountered a situation where my email address was added to an ESP's account and subsequently to a drip campaign without my permission. This experience highlighted the fundamental problems that arise when consent is bypassed.
When I questioned why I was receiving these emails, the response from the ESP's CEO was dismissive, suggesting I simply unsubscribe. This attitude, coupled with the revelation that someone was paying for my access to an account I didn't activate, points to a broken system. Such practices can lead to severe consequences, impacting deliverability and damaging reputation.
The core problem lies in the absence of permission, which is the cornerstone of ethical and effective email marketing. Without consent, ESPs and their users are effectively engaging in unsolicited communication, leading to a cascade of negative outcomes that undermine trust and deliverability.
Legal and compliance ramifications
One of the most immediate and serious issues with adding addresses without consent is the violation of anti-spam legislation and data privacy regulations. Laws like GDPR in Europe, CAN-SPAM in the United States, and CASL in Canada mandate explicit consent for sending marketing communications. Failure to comply can result in hefty fines and legal action, causing significant financial and reputational damage to the sender and potentially the ESP.
These regulations prioritize recipient rights and aim to curb unsolicited commercial messages. For instance, GDPR requires clear, affirmative consent, meaning individuals must actively opt-in. Sending to unconsented lists is a direct breach, making businesses vulnerable to legal challenges and regulatory scrutiny.
Beyond the legal repercussions, ignoring consent fosters a culture of disregard for privacy. This can erode customer trust and brand loyalty. Understanding anti-spam legislation for ethical email marketing is crucial for any business leveraging email for outreach. Moreover, practices like scraping emails and ignoring CAN-SPAM can lead to severe penalties.
Consent-based sending
Compliance: Adheres to global anti-spam and privacy regulations, mitigating legal risks and penalties.
Engagement: Higher open and click-through rates due to genuine interest from recipients, improving campaign performance.
Deliverability: Builds a positive sender reputation, ensuring emails land in the inbox rather than the spam folder.
Impact on sender reputation and deliverability
Sending emails without consent directly harms an ESP's (and its clients') sender reputation. Internet Service Providers (ISPs) and mailbox providers (like Google and Yahoo) employ sophisticated spam filters that track various metrics, including complaint rates, engagement, and bounce rates. When recipients mark unsolicited emails as spam, it signals to ISPs that the sender is distributing unwanted content. This leads to a degraded sender score, which affects future deliverability.
High spam complaint rates can lead to an ESP's IP addresses or domains being placed on various email blacklists (or blocklists). Once an IP or domain is blocklisted, emails from that sender are much more likely to be rejected or routed directly to the spam folder, drastically reducing inbox placement. This impact isn't limited to the specific campaign; it can affect all legitimate email traffic from that ESP or domain.
Furthermore, non-consented lists often contain spam traps, which are email addresses specifically set up by ISPs to catch senders of unsolicited mail. Hitting a spam trap can immediately trigger severe blacklisting. Ultimately, this means lower engagement, reduced ROI on marketing efforts, and a continuous struggle to land emails in the inbox. Non-consent drives more complaints, pushing programs toward non-compliance, throttling, and blocking.
ESP policies and account security
ESPs typically have strict Acceptable Use Policies (AUPs) and Terms of Service (ToS) that explicitly prohibit sending to unconsented lists. When a user adds addresses without consent, they violate these agreements. ESPs are motivated to enforce these policies to protect their shared IP reputation and ensure high deliverability for all their clients. My experience with the CEO's dismissive response highlighted an ESP that might not be adequately enforcing these policies internally.
Upon detecting violations (often through high complaint rates, bounce rates, or spam trap hits), ESPs can take various actions against the offending client. These range from warnings and temporary account suspensions to permanent termination of services. This means a business relying on an ESP for its marketing efforts could lose its ability to communicate via email entirely, crippling its operations.
The operational and financial costs associated with unconsented emailing are substantial, often outweighing any perceived short-term gains. Businesses might initially save time by not requiring opt-in, but this quickly turns into a net loss. The time spent dealing with complaints, handling unsubscribe requests, and trying to get off blocklists diverts resources from productive marketing activities. Recovering a damaged sender reputation can take months, impacting lead generation and sales.
Beyond direct costs, sending to unconsented lists yields poor engagement metrics. Low open rates and click-through rates, coupled with high bounce and spam complaint rates, skew analytics and make it impossible to accurately assess campaign performance. This leads to wasted marketing spend on uninterested audiences and inefficient resource allocation. It's often better to have a smaller, highly engaged list than a large, unconsented one.
The incident where my address was added to an account someone else paid for, without my knowledge or consent, also points to a security vulnerability. If accounts can be created and emails sent without proper authentication or verification, it opens the door for abuse, such as creating spam or fake email addresses for malicious purposes. This can lead to the ESP's infrastructure being exploited for spamming, further harming their reputation and causing significant email deliverability issues.
Embracing a consent-first approach
The issues arising from ESPs and their clients adding addresses to accounts and marketing campaigns without consent are multifaceted and severe. From legal and compliance breaches to devastating impacts on sender reputation and operational inefficiencies, the risks far outweigh any short-term gains. Maintaining a permission-based email strategy is not just a best practice; it's a fundamental requirement for sustainable and effective email marketing.
Views from the trenches
Best practices
Always implement a clear double opt-in process for all new subscribers to ensure explicit consent, verifying their intent to receive your emails.
Regularly audit your email lists to remove inactive subscribers and any addresses for which you lack explicit, verifiable consent.
Educate your team on email marketing compliance laws (GDPR, CAN-SPAM, CASL) to prevent accidental violations and maintain legal standing.
Use clear, concise language in your privacy policy about how subscriber data is collected and used for email marketing purposes.
Monitor your sender reputation metrics, like spam complaint rates and bounce rates, to quickly identify and address any consent-related issues.
Common pitfalls
Adding email addresses from business cards or professional networks to marketing lists without first obtaining explicit, opt-in consent.
Assuming implied consent is sufficient for ongoing marketing communications, especially under strict regulations like GDPR.
Failing to segment lists by consent type, leading to unintentional sending of marketing emails to unconsented transactional contacts.
Ignoring unsubscribe requests or making the unsubscribe process difficult, which increases spam complaints and tarnishes sender reputation.
Using purchased or rented email lists, as these invariably contain unconsented addresses and lead to severe deliverability problems.
Expert tips
Implement robust API integrations that automatically verify consent status before adding new contacts to your marketing campaigns.
Utilize advanced analytics to track subscriber engagement and identify segments that may require re-permissioning or removal to clean your list.
Participate in feedback loops with major ISPs to receive direct notifications when recipients mark your emails as spam, allowing for immediate action.
Develop a standardized, internal protocol for all teams to follow when collecting and managing email addresses, emphasizing consent requirements.
Leverage DMARC reporting to gain insights into email authentication failures, which can often be linked to unauthorized sending or compromised accounts.
Marketer view
Marketer from Email Geeks says adding someone to a drip campaign without their permission, even if an account was created, is a very poor practice.
2021-11-18 - Email Geeks
Marketer view
Marketer from Email Geeks says the situation sounds like a strong case for a GDPR violation.
Google and 
Yahoo) employ sophisticated spam filters that track various metrics, including complaint rates, engagement, and bounce rates. When recipients mark unsolicited emails as spam, it signals to ISPs that the sender is distributing unwanted content. This leads to a degraded sender score, which affects future deliverability.
