- Home
- Membership challenges
- Marketing consent
We're not confident about our marketing consent records
Our consent flags came across from the old database years ago, and nobody can say who ticked them or what people were told. Before every newsletter someone asks whether we can email non-members, or the named contact at a member firm, and nobody is sure. This guide sets out the UK rules and how to rebuild records you can stand behind.
Signs your consent records won’t hold up
- Ask where a contact’s opt-in came from, and the answer is “it was in the old system”.
- A tick says yes, but nobody can show the date, the form or the words the person agreed to.
- Staff aren’t sure whether they can email non-members, event delegates or the main contact at a member firm. So some email everyone, and some email no one.
- Someone unsubscribes from the newsletter and still gets the events bulletin, because the two lists live in different tools.
- Invoices and AGM notices go out from the same list as promotions, so one unsubscribe stops both or neither.
Take a trade association that changed databases in 2019, bringing its opt-in column across as a plain yes or no. Now the events team wants to email a conference offer to 600 people from non-member firms who once downloaded a guide. Nobody can say which of them agreed to marketing, or when.
The flag survived each migration; the evidence didn’t
Consent was saved as a tick, not a record
When someone agreed, staff ticked a box. The form, the date and the words the person saw were not kept with it. Yet the ICO expects you to show who consented, when and how.
Migrations carried the flag, not its history
Each move to a new database brought the opt-in column across and left its source behind. Event and email tools kept their own unsubscribe lists, which never reached the main record.
No one owns the rules
Membership assumes member firms can always be emailed, and events assume delegates opted in. Without one written policy and a named owner, each team decides for itself.
Uncertainty costs you both ways
- Staff time goes on second-guessing lists. Every campaign starts with a debate about who may be emailed, and the list is cut by hand.
- Members lose trust. A member who unsubscribed and still hears from you wonders what else you do with their details.
- Event and training income suffers. Teams that aren’t sure play safe and email a small list, so fewer people hear about what you sell.
- The board can’t get a straight answer. Nobody can say how many contacts you may lawfully email, or produce the records a complaint would ask for.
From 5 February 2026, breaching the PECR marketing rules can bring a fine of up to £17.5m or 4% of worldwide turnover. The Data (Use and Access) Act 2025 raised the cap from £500,000. Not every PECR breach carries this higher maximum. Source (DUAA Sch.13) Source (DPA 2018 s.157)
In 2025/26 the ICO issued nuisance-marketing fines totalling £1.445 million. One was against a company that sent over 67 million marketing emails without valid consent. Source
Five steps to consent records you can stand behind
Audit where each opt-in came from
Export contacts with their opt-in flag and group them by source: web form, event booking, application or import. Find each source’s form and the dates it was live. Anything you can’t trace goes on a review list.
Record the date, source and wording
For every new opt-in, keep the date, where it came from and the exact words the person agreed to. File each version of each form by date, so wording can be matched later.
Review the consent you imported
A limited company’s addresses, even named staff’s, belong to a corporate subscriber, which PECR lets you email without consent. Sole traders and some partnerships count as individuals and need consent or a valid soft opt-in. Ask anyone you can’t prove again at their next booking or call.
Separate service emails from marketing
Invoices, AGM notices and changes to membership terms are service messages. Newsletters and promotions for events, training and campaigns are marketing. Send them from separate lists, and keep promotions out of service messages.
Make unsubscribing easy, and honour it everywhere
Every marketing email, even to a company address, must say who you are and give a way to opt out. A link to a page that needs no sign-in is simplest. Apply each unsubscribe to every list and tool straight away, then test it with an address you have unsubscribed.
This page is general information about UK rules as at October 2026, not legal advice. For decisions about your own contacts, take advice from a data protection specialist.
Opt-in on every contact, and unsubscribes that stick
Colossus keeps an opted-in setting on each contact, leaves unsubscribed contacts out of campaigns and records who changed what.
| What it does | How it works | Plans |
|---|---|---|
| An opted-in setting on each contact | Every contact shows “Opted in to marketing emails”, Yes or No. Staff with update rights change it on the Update Contact form. | CoreGrowthScaleEnterprise |
| Campaigns only to opted-in contacts | An organisation setting under Company Admin > CRM E-Mail Template Settings. When it is on, a campaign goes only to contacts marked as opted in. | CoreGrowthScaleEnterprise Configured during implementation |
| Unsubscribe link and page | Campaign emails link to an unsubscribe page on your own site. Opening the link changes nothing until the recipient presses Unsubscribe; the unsubscribe is then logged against the contact. | CoreGrowthScaleEnterprise |
| Unsubscribed contacts left out automatically | A contact who has unsubscribed is never sent a campaign, whichever list or group added them. The Audience marks them “(unsubscribed)”, and starting the send says how many were not emailed. | CoreGrowthScaleEnterprise |
| Audit trail on contacts | Changes to a contact, including the opted-in setting, are recorded with old and new values, who made them and when. The contact’s audit history lists them. | CoreGrowthScaleEnterprise |
| Opt-in carried across at import | The onboarding contact import reads an “Opted in to marketing emails” column: yes or no, with blank meaning no. Unreadable values are listed by row before anything is written. | Part of onboarding Admin users only |
Colossus records whether a contact is opted in and honours unsubscribes in campaigns. Whether consent is valid, and which rule applies, is your organisation’s decision.
How a trade association rebuilt its consent records
Illustrative example. The British Association of Loading Bay Engineers is a fictional trade association with about 1,200 member firms and 4,000 contacts. This is a composite scenario, not a customer story.
Its opt-in flags had come from an older database in 2018, with no dates or sources. Many smaller members are sole traders, and non-member delegates shared the newsletter list. The membership manager took ownership of the consent rules.
In the Colossus import, the opt-in column said yes only where a dated form could be traced, and everyone else came in as No. PECR would have allowed email to company addresses without consent, but the board chose one rule for everyone. It switched on opt-in-only campaigns.
Staff now ask unproven contacts again at their next booking or call, and tick the box only with a known source. Before the autumn conference, the send said how many contacts were not emailed, and why. When a member asked why her newsletter had stopped, her audit history showed the change and who made it.
Send campaigns only to contacts you can show agreed, and make unsubscribes stick
The British Association of Loading Bay Engineers, a fictional trade association, wants every campaign to go only to contacts marked as opted in, and every unsubscribe to be honoured without anyone remembering to do it.
- Organisation
- British Association of Loading Bay Engineers (fictional), 1,200 members
- Goal
- Mark opt-in on each contact, trace who changed it, send campaigns only to opted-in contacts and show how an unsubscribe is honoured
- Takes
- About 85 seconds, 7 steps
- Plan
- Core, Growth, Scale and Enterprise plans (sending only to opted-in contacts is configured during implementation)
A walkthrough of real Colossus screens with a fictional organisation and demonstration data. Your own set-up, fields and wording will differ.
-
Colossus screen, demonstration data Step 1 of 7Check a contact's opt-in
What you do: Open a contact at a member firm and read the contact details.
What to notice: Every contact shows Opted in to marketing emails, Yes or No, alongside its email, branch and status.
-
Colossus screen, demonstration data Step 2 of 7Set the opt-in once the source is confirmed
What you do: Click the edit button, tick Opted in to marketing emails and save.
What to notice: Only staff with update rights see the edit button. Unticking the box and saving sets the contact back to No.
-
ScreenCRM > Contact > AuditStep 3 of 7
See who changed it and when
What you do: Open the contact's Audit page and set the date range to cover the change.
What to notice: The change appears with its previous and changed values, the member of staff who made it and the date.
-
Colossus screen, demonstration data Step 4 of 7Send campaigns only to opted-in contacts
What you do: In the Campaign emails card, switch on Send campaigns only to contacts who have opted in to marketing emails, then click Save.
What to notice: The card states that contacts who have unsubscribed are never sent a campaign, whether this setting is on or off.
-
Colossus screen, demonstration data Step 5 of 7Build the audience
What you do: Click Add Contacts, search for the contacts to include, tick them and click Save.
What to notice: The search does not mark contacts who have unsubscribed, but they are left out when the campaign is sent.
-
Colossus screen, demonstration data Step 6 of 7Start the send
What you do: Click Start Campaign, tick the statement that you have been granted permission to email these contacts, and confirm.
What to notice: Confirm stays disabled until the statement is ticked. If any contacts were not emailed because they unsubscribed or have not opted in, a message says how many once the campaign starts.
-
Colossus screen, demonstration data Step 7 of 7See what a recipient sees
What you do: Open the unsubscribe link in a test campaign email, then click Unsubscribe.
What to notice: Opening the link changes nothing until the button is pressed, and the page shows only a masked email address. From then on, campaigns leave that contact out.
The result
Each contact shows whether it is opted in, and every change to that setting is in its audit history. Campaigns go only to opted-in contacts, unsubscribed contacts are left out automatically, and starting a send says how many contacts were not emailed and why.
What to measure
Take a baseline from your current list, then check each quarter. The aim is a rising share of contacts whose consent you can show.
- Opted-in contacts with a known sourceThe share of opted-in contacts for whom you can show the date, source and wording.Higher is better
- Contacts still awaiting reviewImported or untraced contacts you have not yet sorted.Lower is better
- Time to honour an unsubscribe everywhereFrom the request to the last list or tool updated, checked with a test address.Lower is better; the aim is the same day
- Marketing emails sent after an unsubscribeFound through spot checks, complaints or replies.The aim is none
- Contacts you can email, by basisOpted-in individuals, soft opt-ins and corporate addresses, counted each quarter.Higher is better, if each one has a source
Frequently asked questions
Can we email the main contact at a member company without consent?
Can a trade association use the new charity soft opt-in?
Hasn’t the new law made direct marketing a legitimate interest?
Can we rely on the consent we imported from our old system?
Which Colossus plans include this?
Sources
- legislation.gov.uk, Data (Use and Access) Act 2025, section 114: Use of electronic mail for direct marketing by charities. Inserts PECR regulation 22(3A); in force 5 February 2026 (SI 2026/82). UK statute.
- legislation.gov.uk, Data (Use and Access) Act 2025, Schedule 13 (introduced by section 115), with Data Protection Act 2018, section 157 (maximum penalties). In force 5 February 2026. UK statute.
- legislation.gov.uk, Data (Use and Access) Act 2025, section 70, which adds direct marketing to UK GDPR Article 6 as an example of a legitimate interest. Remaining provisions in force 5 February 2026. UK statute.
- Information Commissioner’s Office, How do we comply with the PECR electronic mail marketing rules?, updated 28 April 2026, accessed 18 October 2026. UK regulator guidance.
- Information Commissioner’s Office, Information Commissioner’s Annual Report 2025/26: Objective 1, safeguard and empower people. The regulator’s own figures, UK.
See where your own systems stand
The Membership Systems Health Check is ten multiple-choice questions about your data, renewals, automation, reporting and member experience. You get your score out of 100 on screen straight away, with no email needed to see it.
Prefer to talk it through? Book a tailored demonstration and we will start from this problem, not a feature tour.