New UK Marketing Guidance Sets a Higher Standard for Consent Records

Updated UK guidance makes consent records a practical CRM requirement for email marketing. Small businesses should record the person, purpose, channel, date, source and withdrawal process before sending promotional email. The record should let a team member explain why a message was sent and stop future messages quickly.

The Information Commissioner's Office updated its electronic mail marketing guidance on October 2, 2026. The guidance says organizations normally need consent before sending unsolicited electronic mail marketing to individual subscribers, unless a specific exception applies. The ICO's guidance also says consent should be recorded so a business can demonstrate who consented, when and how.

Why this matters inside a CRM

Many small businesses treat consent as a checkbox attached to a contact record. That approach creates gaps when a sales lead enters through a form, a staff member adds a contact manually, or a customer agrees to one channel but not another.

A useful CRM record connects the permission to the person and the exact marketing activity. It should show what the person agreed to receive, the communication method, the time of consent, the wording presented, and the event that captured the choice.

This information supports daily decisions, not only formal reviews. Before a campaign runs, staff can filter out contacts without a valid permission record, separate email consent from text consent, and identify contacts whose preferences changed.

Record consent as a set of fields

The ICO says valid consent for electronic mail marketing must be freely given, specific, informed and unambiguous. A CRM cannot create valid consent by itself, but it can preserve evidence that supports the business's process.

Capture the person and source

Store the contact's name or other identifier, along with the form, conversation or process that collected the information. Include the date and time, the staff member or system involved, and the original source when those details are available.

Source details matter because a sales lead and an existing customer may have different permissions. A contact added from a purchased list also requires careful review. The ICO says a business using a list must confirm that people gave valid consent for the specific organization and the specific electronic marketing method.

Capture the purpose and channel

Do not use one broad marketing field for every channel. Record separate choices for email, text message and other electronic methods when the business uses them, because consent must cover the method planned.

The purpose should also be clear. A person may agree to service updates without agreeing to promotional messages. A form that combines those purposes can leave the sales team with an unclear record and an unreliable audience.

Preserve the wording and version

Store the consent statement or a reference to its approved version. If the business changes the wording, keep the earlier version linked to contacts who made their choice under it.

This record helps answer a basic question: what did the person see when they agreed? A current form does not necessarily prove what an earlier contact saw months before.

Make withdrawal part of the same record

Consent records are incomplete without withdrawal records. The ICO says people can withdraw consent at any time, and businesses must make withdrawal as easy as giving consent.

When someone unsubscribes, the CRM should record the date, channel, request source and scope. A person may withdraw email permission while still receiving necessary service messages, so the record should distinguish promotional communication from operational communication.

The ICO also says a business must stop direct marketing covered by the withdrawal immediately or as soon as possible. A central suppression status can help prevent an old campaign list, spreadsheet or manual task from restarting messages.

Keep preference changes visible

Do not overwrite the original consent event when a person changes a preference. Preserve the earlier event and add the new status with its date and source.

An activity history can show whether the request came from an unsubscribe link, a reply, a phone conversation or a staff update. That history gives the team a clear audit trail and reduces uncertainty during future campaigns.

Do not rely on the soft opt-in for new leads

The ICO describes a soft opt-in that may allow a business to email or text its own customers in limited circumstances. The guidance states that this exception does not apply to prospective customers or new contacts from purchased lists.

That distinction affects lead capture. A person who requested a quote may be a prospective customer, but the business should not assume that the request automatically permits every future promotional message.

Separate lead inquiries from completed customer relationships in the CRM. Then apply the correct permission rule to each group instead of treating every contact as an existing customer.

Build a consent check into campaign preparation

A practical workflow starts before a message is drafted. Staff should define the audience, identify the lawful basis, confirm the channel, and check that each selected contact has a matching record.

1. Define whether the message is service communication or direct marketing.
2. Choose the audience using consent and preference fields, not only customer status.
3. Exclude contacts with a withdrawal, objection or missing permission record where consent is required.
4. Review the message identity and opt-out method before sending.
5. Save the campaign audience, send date and suppression results for later review.

This process does not require a large staff. It requires consistent fields and a rule that prevents incomplete records from entering a marketing audience.

Separate consent compliance from sales follow-up

A sales team still needs to follow up with inquiries, but promotional follow-up and service-related responses may have different purposes. The CRM should show the reason for contact so staff do not confuse a requested response with continuing marketing permission.

For example, a person may ask for an estimate and expect a reply about that request. That interaction does not automatically explain whether the person agreed to receive unrelated promotional email later.

Use task notes, inquiry status and permission fields together. This gives staff a way to respond to active requests while keeping future marketing decisions tied to documented preferences.

Use reporting to find record gaps

Consent reporting should reveal operational problems, not just count subscribers. Useful reports can show contacts missing a consent source, records without a channel, withdrawal requests waiting for action, and campaigns that included contacts with incomplete data.

Review these reports regularly and assign an owner for corrections. A clean database depends on resolving gaps before the next campaign, not discovering them after a message has gone out.

The updated guidance gives small businesses a clear CRM lesson. Permission is not a single checkbox; it is a dated record of a specific choice, connected to the correct channel and followed by dependable preference controls.