CRM playbook: record consent on every contact

Every contact in your database either can lawfully hear from you by email or cannot — and the difference is a recorded consent basis, not your memory. Canada’s anti-spam law recognizes express consent, which lasts until revoked, and implied consent, which comes from a relationship and expires: an inquiry buys you roughly six months, a client relationship roughly two years. The clocks and categories are unpacked in what is implied consent; this lesson is the workflow that keeps your CRM on the right side of them.

Step 1: learn the three baskets

Express, implied, unknown. Express is a clear, standalone yes — a checked marketing opt-in, a confirmed re-permission click. Implied is inferred from inquiries and business relationships, and it runs on a timer. Unknown is everything else, and unknown is never sendable. Anyone who tells you a bigger list is always better has not read the sending rules.

Step 2: let automatic capture do its work

Most consent in a website-plus-CRM system records itself. An inquiry through your site stamps implied consent from the inquiry. A VOW sign-up records implied consent too — accepting terms of use is not express consent, no matter how the checkbox is worded, because express consent cannot be bundled. The separate marketing opt-in, when a visitor ticks it freely, is what records as express. Imports stamp whatever basis you honestly declared for the batch — which is why the import lesson insisted on one source per batch.

Step 3: record the offline moments manually

Open-house sheet, a “sure, add me to your list” at a showing, a referral introduction — record these on the contact when they happen, with a note of how and when the permission was given. The standard to hold: record it like it will be audited, because the day it matters, it effectively is.

Step 4: treat unsubscribes as sacred

An unsubscribe is a permanent suppression, and suppression beats any consent you hold — a contact who opted out stays out even if they later inquire again. Never re-add someone by hand around a suppression; a CASL-compliant CRM makes that impossible by design, which protects you from your own optimism.

Step 5: renew before the clock runs out

Implied consent expiring is not a crisis; it is a calendar event. For segments whose window is closing, run a re-permission play — a plain, honest “want to keep hearing from me?” note whose confirmation click records express consent with evidence attached. Do it while you still lawfully can; after expiry, email is off the table and the phone is your channel.

What done looks like

No contact carries a blank consent basis. New captures stamp themselves, offline permissions get recorded the day they happen, and your nurture plans send only to people entitled to receive them — automatically.

The mistake that costs the most

Treating possession of an email address as permission to use it. A list you bought, inherited, or scraped carries no consent at all, and one broadcast to it can generate the complaint that puts your whole sending reputation — and your compliance record — in question. When in doubt, mark it unknown and earn the permission properly.