List Rental and Co-Registration Under EU Consent Law

Most of what is offered as list rental in this market cannot lawfully be bought by a regulated advertiser, and the failure sits in the consent wording rather than the quality of the file. I have never cleared a raw file transfer for a client and do not expect to. What I will run is a host-mailed rental, in which the list owner sends and the addresses never move. Where the offers fail: Article 7(2) GDPR requires a request for consent to be separable and in plain language; article 13 requires the controller to be identified at the point of collection. A checkbox reading "and our trusted partners", with the partner list one click away and revised every quarter, satisfies neither. Where the partner list changed after the address was collected, consent for the new partner never existed at all. Since 10 November 2024 Polish direct electronic marketing consent has lived in Prawo komunikacji elektronicznej, which replaced the split between article 10 of the UŚUDE and article 172 of the old telecoms act, so consents gathered under either earlier formulation have to be read rather than assumed. What I ask the list owner for: The consent text as it stood on the day of collection, not the text on the site today. Timestamp, source URL and IP for a sample of records that I choose. The refresh and retention policy. Whether the partner list was enumerated at collection. The data processing agreement, and a written position on whether they consider themselves controller, processor or joint controller. Article 26 expects the essence of a joint arrangement to be available to the data subject, and almost nobody has that ready. The only structure I will run: The owner sends from their own domain, their own platform, their own unsubscribe. The client never receives the file. Response is captured on the client's landing page, where a fresh and specific opt-in is collected for any further contact. That opt-in is the only thing that joins the client's own file, and it is the real deliverable: a rental producing traffic and no permission has produced nothing that lasts past the invoice. Co-registration: Single-partner co-registration I will run, where the checkbox names my client by legal entity name at the moment of collection. Multi-partner flows I decline. Their economics depend on the buyer never asking which other twenty companies were named on that page, and for a KNF-supervised or URE-facing brand the answer is always a problem. Measurement and stop conditions: Rental is priced on delivered thousands and reconciled against the owner's send log. A complaint rate above 0.10 per cent on any send stops the programme. Google's published bulk sender threshold is 0.30 per cent, but a properly consented rented audience sits far below it, and a figure climbing toward that threshold is evidence about the consent rather than about the creative. Not included: Data purchase, appending, enrichment, verification of acquired files, and any American-style approach in which mail runs until somebody objects. Where a client wants a file to load into their own platform, this is not the engagement, and I will say so on the first call rather than the fourth. Who this is not for: Growth teams carrying a net-new-contact target this quarter. This work reliably yields fewer addresses than the plan assumed, together with a defensible basis for mailing them. If the target is the number rather than the basis, another practitioner will make you happier and I will not be the one arguing about it in eighteen months when the regulator asks where the addresses came from.