Consent and Identity Across Marketing Cloud Products

The hardest consent question is not what the regulation says. It is which system your organisation believes when two of them disagree.

Consent has more than one shape

• Channel-level: may we email this person at all.
• Topic-level: may we email them about this particular thing.
• Legal basis: why we believe we may, and what we would show an auditor.
• Proof: when they told us, through which form, and what the wording said.

Most implementations model the first two and lose the last two. The last two are the ones that matter when someone complains.

One system of record

Pick the system that owns the answer — commonly CRM or a dedicated preference store — and make every other system a reader. Marketing Cloud can hold a synced copy for send-time exclusion; it should not be a second place where people can be opted back in.

Enforce at send time

Segmentation-time filtering is not enforcement. Between building an audience and pressing send, people change their minds. The exclusion has to be evaluated as late as the platform allows, every time, including for transactional-looking sends that are quietly promotional.

A question to settle early

When identity resolution merges two profiles with different consent states, what is the result? The safe answer — the most restrictive state wins — is rarely the default, and it is a one-line decision that saves an incident later.

This is architecture guidance, not legal advice. Your privacy counsel owns the interpretation; you own making the system match it.