Blog/Compliance
Compliance · 11 Sep 2026 · 8 min

An email opt-in is not an SMS opt-in, and it is definitely not a WhatsApp opt-in

Four channels, four legal bases, one checkout form. What you can reuse, what you have to ask for again, and what auditors look at first.

Consent is per channel and per purpose, not per company

The most expensive assumption in ecommerce marketing is that permission is a property of a person. It is not. Permission is a property of a channel, a purpose and a moment, and that is true under every serious regime — the EU's GDPR and ePrivacy rules, the US TCPA and CAN-SPAM, Canada's CASL, and the platform terms of Meta and the mobile carriers on top of them.

This is the part teams get wrong when they add a second channel. The email list is 40,000 people. The SMS list, honestly counted, is the few thousand who saw a phone field with a clear description of what it was for.

The EU: two laws stacked on each other

GDPR defines what valid consent looks like: freely given, specific, informed and unambiguous, given by a clear affirmative action, and as easy to withdraw as it was to give. Pre-ticked boxes do not qualify, and neither does a checkbox that bundles “newsletter, SMS and partner offers” into one line.

The ePrivacy Directive then governs the act of sending. Article 13 requires prior consent for unsolicited electronic marketing, with one narrow exception that most shops rely on without knowing its name: the soft opt-in. If you obtained the contact details in the context of a sale, you may market your own similar products to that customer, provided you offered a free and easy refusal at collection and in every message. Member states implement the detail differently, so the safe reading is the strict one.

  • Soft opt-in covers your own similar products, not a partner's, and not an unrelated category.
  • It applies to the person who bought, not to everyone who filled in a form.
  • It does not survive the transfer of a list to another legal entity.

The US: email and SMS are governed by different statutes

CAN-SPAM regulates commercial email and works on an opt-out model: you may email without prior consent, but you must identify yourself, give a real postal address, honour an unsubscribe within 10 business days, and never use deceptive headers or subject lines.

SMS is a different world. The TCPA requires prior express written consent for marketing texts sent with an automatic dialling system, and the penalties are per message. The FCC's rule requiring one-to-one consent per identified seller was vacated by the Eleventh Circuit in January 2025, days before it would have taken effect — which changed the compliance deadline, not the underlying duty to get real consent. Carrier codes of conduct add their own requirements on top: disclosure of message frequency, “message and data rates may apply”, and working STOP handling.

A phone number in your database is not a permission to text it
A phone number in your database is not a permission to text it · Photo by Kelly Sikkema on Unsplash

Messaging platforms add a private rulebook

WhatsApp and similar business messaging channels are not just a legal question. Meta's business messaging policy requires an opt-in obtained through a channel the user recognises, stating the business name and that they will receive messages on WhatsApp. Template content is reviewed and categorised before it can be sent, and marketing templates can be paused or rejected for reasons that have nothing to do with the law and everything to do with platform quality scores.

Practically, this means your WhatsApp list can only ever be built deliberately. There is no bulk import that survives contact with reality.

If you cannot show the timestamp, the wording and the page where someone agreed to a specific channel, you do not have consent for that channel. You have a phone number.

Collecting four permissions without four forms

  1. One form, separate ticks. Email, SMS and WhatsApp each get their own unticked box with its own one-line description. Bundling is the single most common finding in enforcement decisions.
  2. Ask in context, not at checkout only. A back-in-stock alert is the best possible moment to ask for SMS, because the value is obvious and immediate.
  3. Record everything. Timestamp, IP or device, form version, the exact wording shown, and the source page. Store it next to the profile, not in a log that rotates away.
  4. Make withdrawal symmetric. If it took one click to subscribe, one click has to remove it. A login wall in front of an unsubscribe page is a finding waiting to happen.
  5. Sunset quietly. Consent does not formally expire in the EU, but regulators expect it to be refreshed when it goes stale, and deliverability punishes old addresses long before a regulator notices.

What an auditor opens first

In our experience of migrations, three things get checked before anything else: whether the consent record survived the move from the previous platform, whether the unsubscribe link works without a login, and whether a single tick ever created more than one permission. Everything else is negotiable. Those three are not.

The honest summary: a smaller list with a clean record is worth more than a big one you cannot defend, because the big one will not deliver anyway.

Sources and further reading (9)
  1. GDPR Article 7 — Conditions for consent
  2. GDPR Article 4(11) — Definition of consent
  3. Directive 2002/58/EC (ePrivacy), Article 13 — Unsolicited communications
  4. EDPB — Guidelines 05/2020 on consent under Regulation 2016/679
  5. FTC — CAN-SPAM Act: A compliance guide for business
  6. FCC — Telephone Consumer Protection Act rules
  7. Insurance Marketing Coalition v. FCC (11th Cir., January 2025) — one-to-one consent rule vacated
  8. Government of Canada — Canada's Anti-Spam Legislation
  9. Meta — WhatsApp Business Messaging Policy

Checked on 21 September 2026. Provider prices, mailbox rules and legal guidance change — verify anything you plan to act on.

Consent, stored per channel

Four permissions, one profile, one audit trail

Auralata keeps a separate consent state for email, SMS, WhatsApp and Viber on every profile, with the timestamp, the source and the exact wording that was shown. Campaigns can only target the channel that was actually agreed to.

Start now See how it works
Profile · consentsince 14 Mar 2026
EmailOpted in
SMSOpted in
WhatsAppNot asked
ViberNot asked
This profile is excluded from WhatsApp campaigns automatically.
More from the blog

Everything else we have written down.

Leaving Klaviyo: what actually moves, what has to be rebuilt, and what you lose Migration · 11 min Leaving Klaviyo: what actually moves, what has to be rebuilt, and what you lose Profiles, consent, suppressions, lists, segments and events come across through the API. Flows do not, and neither does your sending reputation. The honest inventory, endpoint by endpoint. Ecommerce SEO: the four things that compound, and the rest that does not SEO · 8 min Ecommerce SEO: the four things that compound, and the rest that does not Product data, structured markup, one canonical page per product and copy a person would actually read. Everything else is a rounding error on a catalogue of a thousand items. Gmail clips your email at about 102 kB. Here is what it costs you. Deliverability · 7 min Gmail clips your email at about 102 kB. Here is what it costs you. The unsubscribe link, the tracking pixel and half your products end up behind a “View entire message” link. The fix is boring and takes ten minutes. The bulk sender rules are not new any more. Most shops still fail one of them. Deliverability · 8 min The bulk sender rules are not new any more. Most shops still fail one of them. SPF, DKIM, DMARC, one-click unsubscribe and a complaint rate under 0.3 %. A checklist you can finish this afternoon, and the one item that quietly breaks later. The abandoned cart flow that does not sound desperate Flows · 7 min The abandoned cart flow that does not sound desperate Three messages, one discount at most, and a condition that checks whether they already bought. Plus the legal detail most shops get wrong about cart reminders. The open rate has been broken since 2021. Here is what to report instead. Measurement · 7 min The open rate has been broken since 2021. Here is what to report instead. Apple's Mail Privacy Protection pre-loads your tracking pixel whether or not anyone read the message. Four metrics that survived, and one that got more important. WhatsApp now charges per message, not per conversation. Budget accordingly. Channels · 7 min WhatsApp now charges per message, not per conversation. Budget accordingly. The 24-hour conversation window stopped being the billing unit in July 2025. What changed, what is still free, and when a WhatsApp campaign beats an email. AI product images: generate the scene, never the product Content · 8 min AI product images: generate the scene, never the product Generated backgrounds are fine and legal. Generated labels, generated fabric and generated features are a returns problem and, since August 2026, a disclosure problem. Segments that survive contact with a real catalogue Audiences · 7 min Segments that survive contact with a real catalogue Six definitions that still work when the shop has 1,200 products, half of them seasonal, and someone renames a category on a Tuesday. Your customer list is still the best ad audience. It is just harder to upload now. Advertising · 7 min Your customer list is still the best ad audience. It is just harder to upload now. Consent Mode v2, hashed matching and server-side events, explained for people who have to run the campaign rather than argue about it. Never send marketing and receipts from the same subdomain Infrastructure · 6 min Never send marketing and receipts from the same subdomain One bad campaign should not stop order confirmations from arriving. Separating the two takes an afternoon and is the cheapest insurance in email. The welcome series is the only flow that pays for itself in week one Flows · 7 min The welcome series is the only flow that pays for itself in week one Three emails to people who have just decided they are interested in you. What goes in each, why the first one should not sell, and the two mistakes that waste the best audience you will ever have. Browse abandonment is not cart abandonment, and sending the same email costs you both Flows · 7 min Browse abandonment is not cart abandonment, and sending the same email costs you both A cart is an interrupted decision; a browse is an open question. The email that recovers one reads as surveillance when you send it for the other. Timing, wording and the threshold worth having. The second order is the one that matters. A post-purchase flow that earns it. Flows · 8 min The second order is the one that matters. A post-purchase flow that earns it. Most shops say nothing for a fortnight after an order, then ask for a review on day two. What to send between delivery and the second purchase, and why the timing comes from your own data. Win-back flows: what to send at 90 days, 180 days and never Flows · 7 min Win-back flows: what to send at 90 days, 180 days and never A lapsed customer is not a prospect. Three tiers by how long they have been gone, why the discount belongs last rather than first, and the point at which stopping beats escalating. Replenishment reminders: the right day is already in your order table Flows · 7 min Replenishment reminders: the right day is already in your order table If you sell anything that runs out, the best automation you own is a reminder timed to when it runs out. How to compute the interval per product from real repeat orders, and what to do when it is bimodal. RFM segmentation for ecommerce: how to build it without a spreadsheet Audiences · 7 min RFM segmentation for ecommerce: how to build it without a spreadsheet RFM needs three fields you already have. How to score customers, why four groups beat 125 cells, and the message each group should get — without exporting anything to a spreadsheet. Sending from a new domain: how to get the first thousand emails delivered Deliverability · 7 min Sending from a new domain: how to get the first thousand emails delivered A new sending domain has no reputation, and mailbox providers treat that closer to bad than good. Authentication, the first audience, volume ramp, and the three signals that decide the next hundred thousand. Double opt-in in the EU: when it is required and how to implement it Compliance · 8 min Double opt-in in the EU: when it is required and how to implement it The GDPR never says "double opt-in", but several national regulators effectively require it. Where it is expected, where single opt-in holds up, and how to build a record that survives a complaint. SMS marketing in Europe: what it costs and how to launch it properly Channels · 7 min SMS marketing in Europe: what it costs and how to launch it properly Sender IDs are registered per country, opt-out handling is mandatory, and the price per message varies more than tenfold across the EU. The practical checklist before your first campaign. Product photography for AI: how to shoot images a model can work from Content · 7 min Product photography for AI: how to shoot images a model can work from The source photo decides almost everything about a generated lifestyle image. What to shoot, how to light it, and the four mistakes that make a product impossible to place convincingly. Revenue per recipient: how to calculate it and why it beats open rate Measurement · 7 min Revenue per recipient: how to calculate it and why it beats open rate One number that compares a campaign to a flow to a channel. What to include, what to exclude, the attribution window it depends on, and the two variants worth reporting beside it. Customer match after consent mode: how to keep uploading audiences lawfully Advertising · 7 min Customer match after consent mode: how to keep uploading audiences lawfully Your customer list is still the strongest ad audience you own. What consent mode changed, why hashing is not anonymisation, and how to keep uploads lawful without shrinking the audience to nothing. Lost webhooks: how to catch the drift with a nightly reconcile Infrastructure · 7 min Lost webhooks: how to catch the drift with a nightly reconcile WordPress will drop a hook eventually, and nothing errors when it does. Why webhooks alone are never enough, how to build a nightly checksum reconcile, and the three bugs that make it lie to you. Migrate from Mailchimp: what it takes and how to do it Migration · 8 min Migrate from Mailchimp: what it takes and how to do it Contacts and tags export cleanly; consent history, automations and sending reputation do not. What actually moves, what has to be rebuilt, the order to do it in, and how to avoid a deliverability cliff. Product page SEO: how to earn a second visit from search SEO · 7 min Product page SEO: how to earn a second visit from search Most product pages are a photo, a price and the manufacturer's paragraph — the same page a hundred other shops have. What to add so it is worth ranking, in the order that pays back. Engagement gating: how to set it up and why it belongs at send time Audiences · 7 min Engagement gating: how to set it up and why it belongs at send time Filtering dormant addresses is the cheapest deliverability work available. Why the gate has to run at send time rather than at list build, what window to use, and how to exempt transactional mail correctly. SPF, DKIM and DMARC: how to set all three up and what each one stops Deliverability · 8 min SPF, DKIM and DMARC: how to set all three up and what each one stops Three DNS records explained by what breaks without each one. The ten-lookup limit that silently kills SPF, why DKIM needs a selector per service, and how to move DMARC to reject without losing mail. Data processing agreements: what has to be in one and how to get it signed Compliance · 7 min Data processing agreements: what has to be in one and how to get it signed Article 28 requires a contract with specific contents before a supplier touches customer data. What must be in it, which of your tools need one, and the three clauses worth actually reading. The WhatsApp 24-hour window: how it works and how to plan around it Channels · 7 min The WhatsApp 24-hour window: how it works and how to plan around it One clock, started by the customer, decides whether you may write freely or must use a pre-approved template. How the window works, what template approval involves, and how pricing follows from both. One photo into six formats: how to write a brief that holds Content · 7 min One photo into six formats: how to write a brief that holds Six surfaces, six framing problems, one source photo. How to write a format brief that produces all of them consistently — and the safe areas that decide whether the crop survives. Attribution windows: how to choose one and stick to it Measurement · 7 min Attribution windows: how to choose one and stick to it Seven days or thirty, click or view, last touch or first. Every answer is defensible; changing answers mid-year is not. How to pick a window, write it down, and read platform numbers against it. Product feeds for Google and Meta: how to keep price and stock honest Advertising · 7 min Product feeds for Google and Meta: how to keep price and stock honest A feed is a continuous promise that a product exists at that price and can be bought today. How often to refresh, which fields decide whether you rank, and the mismatches that get an account suspended. Idempotency for shop integrations: how to build it and why it is the whole contract Infrastructure · 7 min Idempotency for shop integrations: how to build it and why it is the whole contract Any system that retries will deliver the same event twice. How to choose an idempotency key, why a duplicate must answer success rather than 500, and the three places double-counting actually shows up. Move your sending domain: how to migrate without losing reputation Migration · 7 min Move your sending domain: how to migrate without losing reputation Reputation attaches to the domain and the IP, and neither transfers. Why to change one thing at a time, how to split traffic during the move, and the DNS record that must be removed afterwards. Product structured data: how to implement it so it matches the page SEO · 7 min Product structured data: how to implement it so it matches the page Markup tells search engines what a page means. Which properties matter, why price and availability must match the visible page, and the review markup that earns a manual action. Segment size and revenue: how to find the smaller list that earns more Audiences · 7 min Segment size and revenue: how to find the smaller list that earns more The instinct before a big campaign is to widen the audience. How to test the opposite on your own data, why revenue per recipient falls as the list grows, and where the real ceiling sits. Spam traps: how they get onto a clean list and how to get them off Deliverability · 7 min Spam traps: how they get onto a clean list and how to get them off A spam trap is an address that could not possibly have consented. The three kinds, how each arrives on an otherwise clean list, and why deleting them is not how you fix the problem. One-click unsubscribe: how to implement RFC 8058 and stay compliant Compliance · 7 min One-click unsubscribe: how to implement RFC 8058 and stay compliant Two headers and an endpoint, required by Google and Yahoo for bulk senders. What to send, what the endpoint must do, the two-day rule, and why the footer link still has to exist. Viber or WhatsApp: how to choose for a European shop Channels · 7 min Viber or WhatsApp: how to choose for a European shop The answer is mostly geography and partly pricing. How to find out which app your customers actually use, what each costs, and why running both is usually worse than running one well. Email subject lines: how to write ones that survive the preview pane Content · 7 min Email subject lines: how to write ones that survive the preview pane A subject is read in about forty characters beside a preheader you probably did not write. What survives the preview pane, how to use the preheader properly, and why most A/B tests prove nothing. Holdout groups: how to run one and what it will tell you Measurement · 7 min Holdout groups: how to run one and what it will tell you Attribution tells you which message a buyer saw last; a holdout tells you whether it changed anything. How to size one, where to run it permanently, and how to read a result that comes back at zero. Retargeting with a shrinking pool: how to keep it working Advertising · 7 min Retargeting with a shrinking pool: how to keep it working Consent banners and browser restrictions have cut retargetable audiences to a fraction of site traffic. What still works, why first-party segments outperform pixel pools, and when to stop spending on it. Storing prices with tax and currency: how to get totals right for every shop Infrastructure · 8 min Storing prices with tax and currency: how to get totals right for every shop A number in a price column means nothing alone. Why currency, tax inclusion, rate and shipping must each be stored, and the four calculations that go wrong when any of them is assumed. Rebuilding flows after a migration: how to recreate what will not export Migration · 7 min Rebuilding flows after a migration: how to recreate what will not export Automations have no useful export format. What to document before you lose access, the order to rebuild in, and why exit conditions matter more than the copy you are worried about. Faceted navigation and crawl budget: how to stop wasting it SEO · 7 min Faceted navigation and crawl budget: how to stop wasting it Three filters with four values each produce more URLs than most shops have products. How to decide which facets deserve indexing, and the four controls that stop the rest eating your crawl budget. Lookalike audiences: how to pick a seed that actually works Audiences · 7 min Lookalike audiences: how to pick a seed that actually works The platform's model is rarely the problem; the seed is. How to choose one, why a smaller high-value seed beats your whole customer list, and how often to refresh it. Domain warm-up: how to ramp sending volume week by week Deliverability · 7 min Domain warm-up: how to ramp sending volume week by week A concrete four-week ramp, what to check before each increase, and the hold rule that matters more than the schedule itself. Plus why consistency beats volume for a new sender. Proof of consent: how to record it so it holds up with a regulator Compliance · 7 min Proof of consent: how to record it so it holds up with a regulator Article 7 puts the burden on you to demonstrate consent was given. What a defensible record contains, how to version the wording, how long to keep it, and what to do about consents you inherited. Push notifications for ecommerce: when to use them and how to write them Channels · 7 min Push notifications for ecommerce: when to use them and how to write them Web push is cheap, instant, and the fastest permission to lose for ever. What it is actually good for, how to ask for the permission, and the frequency that quietly destroys the channel. Alt text for email and ecommerce: how to write it and why it is read first Content · 7 min Alt text for email and ecommerce: how to write it and why it is read first Many inboxes block images by default, making alt text the first thing read. How to write it for products, decorative images and image-only emails, and the mistakes that make it useless. Ecommerce analytics: how to count people instead of clicks Measurement · 7 min Ecommerce analytics: how to count people instead of clicks A visitor who refreshes ten times is one visitor. Why session-based metrics mislead, the four numbers worth reporting, and how to handle the traffic that consent rules make invisible. Conversions API: what it fixes, what it does not, and how to set it up Advertising · 7 min Conversions API: what it fixes, what it does not, and how to set it up Server-side events recover measurement that ad blockers and browser limits removed. What they genuinely fix, why deduplication matters, and why this is not a route around a visitor's refusal. Sync lag: how to find out your data is an hour behind, and fix it Infrastructure · 7 min Sync lag: how to find out your data is an hour behind, and fix it Stale data does not announce itself — everything renders and every number looks plausible. How to measure real end-to-end lag, the three causes worth checking first, and what to put on screen. Running two marketing tools at once: how to plan the overlap Migration · 7 min Running two marketing tools at once: how to plan the overlap The fortnight where both platforms are live is cheap insurance and an easy way to send everything twice. What to switch when, the three rules that prevent duplicates, and how to compare fairly. Category page SEO: how to make them the pages that rank SEO · 7 min Category page SEO: how to make them the pages that rank People search for the category and buy from the product. Why category pages carry the ranking, what copy belongs on them, and how to handle pagination, sorting and thin categories. Profile merging across devices: how identity resolution actually works Audiences · 7 min Profile merging across devices: how identity resolution actually works A phone and a laptop are two records until something connects them. What the identifiers are, what should happen at the moment of a merge, and why creating the profile early is the whole point. Bounce handling: how to tell a soft bounce that should be treated as hard Deliverability · 7 min Bounce handling: how to tell a soft bounce that should be treated as hard A hard bounce is permanent and a soft bounce is temporary — until you meet the ones that repeat for ever. How to classify by code and by repetition, and the retry schedule that stops the damage. Data retention for ecommerce: how long to keep customer data and how to delete it Compliance · 7 min Data retention for ecommerce: how long to keep customer data and how to delete it There is no single retention period, because different data has different clocks. How to set one per category, why deletion means anonymisation for orders, and what a deletion request actually requires. Choosing a channel per message: a framework that holds up Channels · 7 min Choosing a channel per message: a framework that holds up Email, SMS, WhatsApp and push have different costs, permissions and tolerances for interruption. Three questions that decide where a message belongs, and a table of the common cases. AI product images: when to use them and when not to Content · 7 min AI product images: when to use them and when not to Generating a background is ordinary image editing at scale. Generating the product, or a claim about it, is not. Where the line sits, what EU rules require, and the four checks before publishing. Reconciling ad platform numbers: why they never match and what to trust Measurement · 7 min Reconciling ad platform numbers: why they never match and what to trust Meta says 340, Google says 210, your shop recorded 402 orders total. Five structural reasons they disagree, which number to plan with, and the ratio worth tracking instead. Splitting ad budget without reliable attribution: how to decide Advertising · 7 min Splitting ad budget without reliable attribution: how to decide Attribution got worse and is not coming back. How to allocate budget using holdouts, marginal tests and a stable baseline rather than waiting for a number you will never have. Time zones in reporting: how to stop them breaking one report a quarter Infrastructure · 7 min Time zones in reporting: how to stop them breaking one report a quarter A day is not a fixed thing. Where to store times, where to convert them, why scheduled sends need the shop's clock, and the daylight-saving cases that break a report twice a year. After a migration: what to check on day one Migration · 7 min After a migration: what to check on day one Most migration problems that become expensive were visible on day one. A checklist in priority order, the two numbers to watch for a fortnight, and what to keep before cancelling anything. Ecommerce blog strategy: which posts to write and which to skip SEO · 7 min Ecommerce blog strategy: which posts to write and which to skip Most shop blogs are company news and seasonal filler. The four kinds of post that earn traffic which converts, the three that never do, and how to link them to the products. Back-in-stock alerts: how to build the flow and what it is worth Flows · 12 min Back-in-stock alerts: how to build the flow and what it is worth A back-in-stock request is the clearest purchase intent a shop ever receives. How to capture it, how fast the alert has to be, how to handle variants and thin restocks, how to write it, and the demand signal it hands your buyer. Review requests: how to ask so people actually answer Flows · 12 min Review requests: how to ask so people actually answer Reviews are the cheapest high-converting content a shop can produce. When to ask, why one specific question beats a star widget, what to do with bad reviews, what EU law now requires, and how to get the value back out. VIP customers: how to identify them and what to actually do for them Flows · 12 min VIP customers: how to identify them and what to actually do for them Most shops define VIPs by lifetime spend and reward them with the discount everyone gets. How to define the group so it stays current, why recognition outperforms discounting, the entry message, and how to handle people falling out.