Why it matters
Withdrawal of consent takes effect immediately - not “after the campaign ends”. Sending any message after that point means the data is being processed without a lawful basis.
Where things go wrong
- Campaigns are planned and triggered automatically (CRM, marketing automation, SMS gateway).
- Customer data lives in multiple systems (marketing, sales, helpdesk).
- Systems don’t always talk to each other in real time.
- Some teams still import mailing lists manually — e.g. last week’s spreadsheet.
The result? Someone who has just opted out may still receive another message, and the organisation ends up explaining itself to the supervisory authority.
A real-world example
A retail customer unsubscribed on 12 May at 11:02. At 12:00 the same day, the sending platform launched a discount campaign from a list prepared on 10 May. Before the database refreshed, the email had gone to 400 people — including the person who had withdrawn consent. A complaint went to the regulator, and “our database hadn’t updated yet” wasn’t accepted as a sufficient explanation.
What you can do
Before launching a campaign
- Use live segments, not files: build audience lists dynamically from the current consent/objection status (via CRM/API), not from CSVs.
- Block on data quality: pause sending if there are duplicates or out-of-sync records.
- Agree an update window: with IT, define how quickly consent changes propagate across systems (minutes, hours or days).
During the campaign
- Enforce a technical block: before each send, the platform must check the latest consent status and automatically exclude ineligible contacts.
- Log the evidence: record a consent ID and/or the date of grant/withdrawal in send logs so you can verify status at the moment of dispatch.
After the campaign
- Tidy up: delete temporary mailing lists and exported spreadsheets.
- Update the base: remove anyone who unsubscribed after receiving the campaign so they are excluded from future sends.
Remember
Consent withdrawal applies there and then. Any system that can’t reflect that in near real time is a compliance risk. Before you hit send, test the obvious: does your “unsubscribe” truly work here and now across every channel?