Consent

In data protection and email law, consent is a person's freely given, specific, informed and unambiguous agreement to have their data processed or to receive messages. It must be a clear affirmative action, and it can be withdrawn at any time.

Compliance & PrivacyUpdated September 30, 2026

In short

Consent is a clear, recorded yes that a person can take back at any time; some laws require it for marketing email, while others allow outreach without it.

Key points

  1. The GDPR defines consent in Article 4(11) as freely given, specific, informed and unambiguous, given by a statement or clear affirmative action [1].
  2. Article 7 requires you to be able to prove consent, and withdrawing it must be as easy as giving it [2].
  3. Pre-ticked boxes, silence and inactivity are not valid consent, according to both the EDPB and the ICO [3][4].
  4. Consent is only one of six lawful bases; for B2B Cold Email, many senders rely on Legitimate Interest instead [4].
  5. Some email laws require consent regardless: CASL for most commercial messages, and PECR for individual subscribers such as sole traders [5].
  6. The US CAN-SPAM Act does not require consent before sending, but it does require a working Opt-Out.

What valid consent looks like

Under the GDPR, valid consent has four parts [1]. Freely given means the person has a real choice and is not penalized for saying no; consent bundled into terms of service usually fails this test. Specific means it covers a defined purpose, such as receiving a monthly product newsletter, not a vague promise of "relevant offers". Informed means the person knows who you are and what they are agreeing to. Unambiguous means a clear affirmative action, like ticking an empty box or typing an email into a signup form labeled for that purpose [3]. Article 7 adds that you must be able to show when and how consent was given, and that withdrawing it must be as easy as giving it [2]. Keep a timestamped record tied to each contact in your CRM (Customer Relationship Management).

Consent versus other lawful bases

A common mistake is treating consent as the only way to process Personal Data. GDPR Article 6 lists six lawful bases, and the ICO advises choosing the one that best fits the purpose, not defaulting to consent [4]. For B2B outreach to a work address, Legitimate Interest is often more appropriate, because you cannot ask for consent without first contacting the person. Consent also carries a cost: if you rely on it and it is withdrawn, you must stop, and you cannot switch to another basis after the fact [3][4]. Where a separate marketing law requires consent, such as CASL or the individual-subscriber rule in PECR, you need it for the email itself, whatever basis you use for the underlying data.

Consent in email marketing laws

Email laws treat consent differently. CASL is consent-first: you need express consent, or one of the narrow forms of implied consent, before sending a commercial electronic message to someone in Canada. PECR requires consent for marketing email to individuals in the UK, with a soft opt-in for existing customers, but not for corporate subscribers [5]. The US CAN-SPAM Act takes the opposite approach and lets you send until the recipient opts out. Mailbox providers apply their own standard through Bulk Sender Requirements: even lawful email that recipients did not ask for can be filtered if too many people report it. The practical lesson is to know which regime each recipient falls under and to record the basis you rely on. This is general information, not legal advice.

Sources
  1. Art. 4 GDPR — Definitions — gdpr-info.eu
  2. Art. 7 GDPR — Conditions for consent — gdpr-info.eu
  3. Guidelines 05/2020 on consent under Regulation 2016/679 — European Data Protection Board
  4. Consent — Information Commissioner's Office
  5. Electronic mail marketing — Information Commissioner's Office
External sources open in a new tab.

Related terms

Legitimate Interest

Legitimate interest is the lawful basis most B2B senders use for cold outreach under GDPR, but only after a documented three-part test and with an easy way to object.

GDPR

GDPR requires a lawful basis, transparency, and respect for individual rights whenever you process personal data about people in the EU, including business contacts.

CASL

CASL is a consent-first law: to email someone in Canada commercially you need express or implied consent, plus clear identification and an unsubscribe that works.

PECR

Under PECR you can email UK companies without consent, but sole traders and some partnerships are treated like individuals and usually need consent or a soft opt-in.

Opt-Out

Every commercial email needs an easy way to say stop, and once someone does, you must stop emailing them within the legal deadline and keep them suppressed.

CAN-SPAM Act

CAN-SPAM lets you send commercial email in the US without prior consent, as long as you are honest about who you are, include an address, and honor opt-outs quickly.

Mentioned in
Cold EmailLead ListOutbound SalesPersonal DataRight to Erasure

Outreach without the busywork.

PineLead finds new B2B prospects every day, qualifies them against your criteria and writes the first email in your voice. You approve — PineLead sends.

Start free with 100 credits →