Why is it important?
The withdrawal of consent takes effect from the moment it is submitted — not “after the campaign ends.” Sending a message after this point means that the data is being processed without a legal basis.
The problem is that:
- marketing campaigns are often planned and launched automatically (CRM, mailing automation, SMS gateway),
- customer data is duplicated across several databases (marketing, sales, helpdesk),
- systems do not always “communicate” with each other in real time,
- some companies still manually import mailing lists — e.g., from Excel from a week ago.
As a result, a customer who has just withdrawn their consent may receive another message, and the organization may have to provide an explanation to the supervisory authority.
Real-life example
In a trading company, a customer unsubscribed from the newsletter on May 12 at 11:02.
On the same day at 12:00, the mailing system sent out a discount campaign from a list prepared… on May 10. Before the database was updated, the mailing had already reached 400 people, including the customer who withdrew their consent. A complaint was filed with the Polish DPA — and the explanation that “the database had not been updated in time” was not deemed sufficient.
What can you do?
Before launching a campaign:
- Ensure that the recipient list is generated dynamically (based on the current consent status), rather than from a CSV file.
- Stop the sending process if there are duplicates or unsynchronized records in the database.
- Determine with the IT department how quickly after consent withdrawal the data is “refreshed” in the systems (minutes, hours, or days).
During the campaign:
- Implement a technical block on sending — the system should check the current consent status before sending and automatically exclude such contacts.
- Log the consent ID or the date of granting/withdrawing consent — this will allow for quick verification of the status at the time of sending.
After the campaign:
- Delete temporary address lists and reports exported to Excel.
- After the campaign, update the database — remove individuals who unsubscribed after receiving the message.
Remember!
The withdrawal of consent takes effect immediately. Any system that cannot reflect this in real time poses a risk of violation. Therefore, before starting a campaign, it is worth checking one thing: whether our “unsubscribe” really works here and now.
