How long does email consent last, and what are the rules?
Updated on 18 Oct 2026: We clarified consent expiry, unsubscribe requirements, and when transactional email can continue after a marketing opt-out.
Email consent lasts only as long as the permission still fits the purpose, source, jurisdiction, and legal basis behind the message. It also ends when the person withdraws it. There is no universal lifetime for consent, so old consent carries more risk when the sender cannot prove when it was collected, what the person agreed to, and whether the current use still matches that agreement.
The practical answer depends on the permission route. Express consent often lasts until withdrawn, provided its scope still covers the message and the sender retains evidence. Implied consent has fixed clocks in some countries. Canada is the clearest example, with common implied consent windows of 2 years after a qualifying transaction and 6 months after an inquiry. In the United States, CAN-SPAM generally does not require prior opt-in for commercial email, but it requires accurate sender information, a valid postal address, honest subject lines, advertisement identification where required, and compliant opt-out handling. EU ePrivacy rules and UK PECR usually require consent for marketing to individuals unless a local exception applies. When consent is the basis under the GDPR or UK GDPR, it has no fixed expiry but must remain freely given, specific, informed, unambiguous, and easy to withdraw.
- Express consent: Keep it until withdrawal, a purpose change, a stated end point, or insufficient proof makes it unusable.
- Implied or inferred consent: Track the legal conditions and any clock by country, relationship type, and last qualifying activity.
- Opt-outs: Treat them as durable suppression records, not temporary preferences.
- Old lists: Do not assume a badge scan, conference chat, business card, public address, or website registration permits marketing years later.
When email consent remains usable
Consent is not a one-time asset that can be stored forever and used whenever marketing needs volume. A stricter operational rule works better: if the sender cannot prove permission or another valid basis, cannot explain the purpose, or cannot match the current message to the original scope, the address should not receive marketing. Low engagement should trigger a risk review, but it does not by itself create or cancel legal permission.
Operational rule
Consent remains usable when the permission record, message purpose, sender identity, jurisdictional rule, and unsubscribe status still match. If any of those fail, stop marketing sends to that address and move it into a permitted refresh, suppression, or legal review path.
- Proof: Store timestamp, source, form text, consent version, and only necessary supporting technical data.
- Scope: Record which brand, list, topic, channel, and message category the person accepted.
- Withdrawal: Suppress the address quickly and keep enough data to prevent future sends.
Sending to a stale list increases complaint risk and can damage sender reputation. Authentication still needs to pass, but SPF, DKIM, and DMARC do not establish recipient permission.
Email consent duration by region
The rules differ by jurisdiction, and the safest retention policy stores the legal basis per contact. Do not keep one global consent flag for every region. A field that says yes tells you almost nothing unless it also includes source, scope, country, date, and withdrawal status.
|
|
|
|---|---|---|
United States | CAN-SPAM generally uses opt-out | Honor within 10 business days |
Canada | Express until withdrawn; common implied periods are 2 years or 6 months | Track qualifying transaction, inquiry, and contract dates |
EU and UK | Consent has no fixed expiry; limited exceptions apply | Prove consent or the exact exception |
Australia | Express or inferred consent | Honor within 5 working days |
B2B contacts | Varies by country and entity type | Do not assume a blanket exemption |
Common consent duration rules, simplified for marketing operations.
For the United States, the CAN-SPAM guide explains the 10 business day opt-out window and the requirement to keep the opt-out mechanism working for at least 30 days after sending. For Canada, the CASL guidance explains express consent, the common 2 year and 6 month implied consent periods, and the sender's burden to prove the basis.
Under CASL, an existing business relationship commonly supports implied consent for 2 years after a qualifying purchase, or 6 months after a qualifying inquiry or application. A qualifying written contract supports it while in force and for 2 years after expiry. These periods do not override an unsubscribe. Record the event date and calculated expiry, as described in the CRTC guidance.
In practice, the strictest applicable rule often becomes the operating rule. A global list that includes Canadian, EU, UK, Australian, and US recipients should not use the US opt-out model for everyone. Segment by country, subscriber type, and legal basis instead.
Email consent validity flowchart covering permission records, regional rules, suppression checks, and send decisions.
Soft opt-in and B2B exceptions
Consent is not the only permission route in every jurisdiction, but an exception needs the same level of documentation. In the EU, electronic marketing rules come from national laws implementing the ePrivacy Directive, so details vary by country. In the UK, PECR has specific soft opt-in rules and distinguishes individual subscribers from corporate subscribers.
- UK customers: The products and services soft opt-in can apply when details were collected directly during a sale or genuine negotiation, the sender markets its own similar products or services, and the person could opt out at collection and in every message.
- UK charities: The charitable purposes soft opt-in applies only to details the charity collected directly on or after 5 February 2026 through an expression of interest in, or support for, its charitable purposes. Messages must solely further those purposes, with opt-out opportunities at collection and in every message. Older supporter records do not qualify automatically.
- UK B2B: The PECR consent rule generally does not apply to corporate subscribers such as limited companies, but sole traders and some partnerships are individual subscribers. Data protection rules still apply to named work addresses.
- Canada and Australia: CASL implied consent and Australian inferred consent have their own conditions. A public work address does not create blanket permission; the message must meet the local relevance and notice rules.
Do not relabel a missing electronic marketing permission as legitimate interests. A GDPR or UK GDPR lawful basis does not replace a consent requirement under national ePrivacy rules or PECR. Store the exact exception, the facts supporting it, the subscriber type, and the date those facts were checked. The ICO electronic mail guidance explains the conditions for both UK soft opt-ins.
What counts as valid consent
Valid consent has evidence. A person giving you an email address is not the same as permission to send marketing. A business card, badge scan, old sales demo, webinar attendee list, conference directory, or one-to-one exchange can prove contact, but each needs separate facts before it can support marketing. A direct event form with clear marketing language can record consent; an organizer's attendee export usually cannot.
Strong evidence
- Form copy: The exact wording showed marketing permission and the sender brand.
- Timestamp: The record includes the date, time, source page, and consent version.
- Choice: The person took a clear action that was not bundled into unrelated terms. Pre-ticked boxes and silence do not establish consent under the GDPR or UK GDPR.
Weak evidence
- Old contact: The address came from an event, meeting, export, or past staff handoff.
- Missing source: The team says the form existed, but no one can produce the form copy.
- Changed scope: The person agreed to one brand, but another brand now wants to mail them.
A consent ledger should be boring and exact. It does not need clever scoring. It needs records that marketing, legal, privacy, and abuse teams can read without guessing.
Consent event recordJSON
{ "email": "person@example.com", "country": "CA", "legal_basis": "express_consent", "consent_source": "newsletter_signup_form", "consent_text_version": "newsletter_v4_2026_01", "brand": "Example Brand", "topics": ["product_updates", "events"], "collected_at": "2026-01-18T09:42:11Z", "last_marketing_sent_at": "2026-05-14T16:02:00Z", "withdrawn_at": null, "proof_url": "internal://consent-record/abc123" }
When consent goes stale
Consent goes stale when the recipient can no longer reasonably connect the email to the permission they gave. That can happen because too much time passed, the sender changed, the topic changed, the business relationship ended, or the list sat unused through several staff changes. Staleness is a context and evidence problem, not a universal statutory expiry date.
Illustrative consent review checkpoints
Example internal review intervals, not legal deadlines or proof of valid permission. Check the legal basis before every send.
Routine review
0-12 months
Recent consent, clear proof, matching topic, and normal sending cadence.
Review
12-24 months
Permission still has proof, but activity or engagement has weakened.
Review before reuse
24+ months
Check older records before reuse. Stop marketing if proof is missing or the current purpose is outside the original permission.
The 12 and 24 month checkpoints are examples, not universal consent expiry dates. The ICO consent guidance says duration depends on context and the original scope. An email open or click is not, by itself, renewed marketing consent and does not restart a CASL relationship clock. Open tracking is also unreliable, so use engagement as a risk signal rather than proof of renewed permission.
Before reactivating an approved dormant segment, send a campaign sample to Suped's email tester. Inspect the message headers and authentication results before sending to recipients. A sample test does not validate legal consent or guarantee inbox placement.
Email tester
Send a real email to this address. Suped shows a results button when the test is ready.
?/43tests passed
Unsubscribe rules and suppression
Withdrawal ends marketing permission. Unsubscribe handling is a compliance system, not a campaign preference buried in a marketing platform. If a contact unsubscribes in one tool and a later migration loses that status, the sender owns the mistake.
Keep suppression effective
- Keep proof: Store enough unsubscribe data to prove and enforce the withdrawal.
- Sync systems: Push suppression status to every sending system and enrichment workflow.
- Block imports: Reject list uploads that try to re-add unsubscribed or complained contacts.
- Audit vendors: Confirm partners honor your suppression file before they send.
The unsubscribe clock is separate from consent age. The US rule allows up to 10 business days and requires the mechanism to process requests for at least 30 days after sending. CASL requires action without delay and no later than 10 business days, while its unsubscribe link must remain valid for at least 60 days. Australia allows up to 5 working days and requires the mechanism to work for at least 30 days. Many senders process withdrawals immediately because delayed suppression creates avoidable complaints. For more country timing, use the legal timeframe guide.
Make unsubscribing free and simple. Under CAN-SPAM, do not demand extra personal information beyond the email address or extra steps beyond a reply email or a single web page. A preference center must also offer a way to stop all marketing from the sender.
Mailbox provider requirements are separate from legal deadlines. Gmail's sender guidance recommends processing unsubscribes within 48 hours; Yahoo's bulk sender requirements require processing within 2 days. For applicable bulk marketing traffic, support RFC 8058 one-click unsubscribe headers as well as a visible unsubscribe link in the message body.
Opt-outs do not expire in the way marketing consent can become stale. A person who opted out should stay suppressed unless they later take a clear, documented action to opt back in. The related opt-out expiry guide covers that distinction in more detail.
A request for consent can itself be a regulated marketing message. Under CASL and Australia's spam rules, a sender generally cannot email a contact only to obtain consent unless another permission route already allows that message. Use a permitted channel, such as an account setting or an in-person form, and record the new choice.
Marketing consent and transactional email
A marketing opt-out does not automatically stop necessary transactional email, such as an order confirmation or account security notice. Under CAN-SPAM, a message's primary purpose determines its classification. A purely transactional or relationship message is exempt from most CAN-SPAM requirements, but accurate routing information is still required. The FTC CAN-SPAM guide explains this narrow exemption.
Mixed messages need separate review. Under US rules, a promotional subject line or placing transactional information after advertising can make the message commercial. Under UK PECR, adding promotional material to an otherwise administrative service message makes it direct marketing, as the ICO service message guidance explains.
Keep promotional content out of essential service templates and apply the relevant regional rules. A past purchase or active account does not make every email transactional.
Consent and deliverability
Consent is legal and operational permission. Deliverability is whether mailbox providers accept and place the mail. Sending unwanted email increases spam complaints and can damage sender reputation even when authentication passes.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Suped's DMARC reporting and email authentication platform supports the authentication checks around a consent workflow. Use DMARC monitoring to review sending sources and SPF or DKIM results, and blocklist monitoring (blacklist monitoring) to investigate listed domains and IP addresses. Keep recipient consent records and suppression controls in the systems that manage your contacts.
Keep two separate gates. First, decide whether the recipient has current permission or another valid basis. Second, decide whether the sending domain, envelope path, authentication, and reputation are healthy enough to send. A pass on one gate never overrides a fail on the other.
Practical Suped workflow
- Verify domains: Confirm SPF, DKIM, and DMARC pass before any permitted consent refresh send.
- Watch sources: Review DMARC reports for unrecognized sending sources before increasing approved campaign volume.
- Check reputation: Monitor blocklist and blacklist signals during approved reactivation campaigns.
- Fix issues: Use issue detection and corrective steps before scaling volume.
A practical consent retention policy
A good retention policy gives marketers a clear answer without asking legal to review every campaign. It should define when permission is usable, when it needs refresh, when it must be suppressed, and when the contact data should be deleted or minimized.
- Capture evidence: Save consent source, wording, timestamp, country, brand, and topic.
- Classify basis: Record express consent, the exact implied-consent or soft opt-in basis, or a lawful opt-out route such as CAN-SPAM. Keep unknown permission separate.
- Set review dates: Review stale records before reactivation, especially after 12 to 24 months of no engagement.
- Protect suppression: Preserve the minimum data needed to enforce unsubscribe and complaint suppression when deleting marketing profiles.
- Block bad imports: Reject lists with missing source, expired implied consent, or mismatched brand permission.
Minimum retention policyTEXT
Express consent: Use until withdrawn, a stated end point, a purpose change, or insufficient proof. Implied or inferred consent: Use only while the local conditions and any legal clock remain satisfied. For time-limited consent, store the qualifying event date and calculated expiry. Dormant contacts: Review after 12-24 months without engagement; do not treat inactivity as automatic legal expiry. Unsubscribed contacts: Keep minimal suppression records for as long as needed to prevent future sends. Document the retention purpose and lawful basis. Unknown source contacts: Do not send marketing. Seek consent only through a permitted channel.
Consent duration and evidence retention are separate decisions. Keep evidence while relying on consent; document any further retention for a legal obligation or justified claims period. Minimize other profile data. The ICO recordkeeping guidance explains consent records and retaining withdrawal data to enforce suppression. Explain that purpose and its lawful basis in your privacy notice.
The hardest cases are old inherited databases. If a company acquisition, CRM migration, agency handoff, or staff turnover breaks the proof chain, do not treat the list as opted in. Treat it as unknown until the record proves otherwise. A business acquisition can transfer some permissions under local rules, but buying only a list does not create the same basis. The related acquired list guide explains why the brand, purpose, original notice, and transaction structure matter.
Views from the trenches
Best practices
Keep consent proof with the address, not in a form builder that later gets deleted.
Review event and conference leads before importing them into marketing automation.
Treat abuse desk replies as audit data and use them to fix broken consent controls.
Common pitfalls
Assuming a business card or speaking slot grants broad marketing permission years later.
Removing a person from one list but leaving them active in another sending platform.
Blaming staff changes instead of fixing the source, suppression, and import process.
Expert tips
Suppress contacts with missing consent proof; obtain fresh consent through a permitted channel.
Block list uploads unless source, date, country, and consent basis are populated.
Test campaign content internally, then send only where the permission basis remains valid.
Marketer view
Marketer from Email Geeks says having an email address does not create permission to send promotional email years later.
2019-06-03 - Email Geeks
Marketer view
Marketer from Email Geeks says old event contact records need proof of consent, not assumptions about implied interest.
2019-06-04 - Email Geeks
Frequently asked questions
There is no universal expiry rule. Express consent often lasts until withdrawal, but a stated end point, changed purpose, changed sender, or missing proof can make it unusable. Review it against the law and the recipient's reasonable expectations.
Common CASL periods are 2 years after a qualifying purchase and 6 months after a qualifying inquiry or application. A qualifying written contract supports an existing business relationship while in force and for 2 years after expiry. Later qualifying events can establish a new period; an email open does not. Express consent has no fixed expiry, and an unsubscribe overrides either basis.
A business card proves contact details were shared. It does not automatically prove permission for ongoing marketing. Some jurisdictions recognize narrow implied or inferred consent when the disclosure was voluntary, no contrary statement appeared, and the message relates to the person's role. Record those facts or obtain express consent.
Not usually in full. Keep enough suppression data to prevent future marketing sends, and avoid keeping profile data that no longer has a valid retention purpose.
Only when a valid permission route already covers that message. Under CASL and Australia's spam rules, an email requesting consent can itself be a regulated commercial message. Use a permitted channel if no existing basis allows the email.
No. A DMARC pass means SPF or DKIM passed using a domain that matches the visible From domain under DMARC rules. It does not prove recipient consent or guarantee inbox placement. Check marketing permission separately from authentication.
