List Rental and Co-Registration Under a Consent Standard

We will not send to a name whose consent record cannot be produced for that individual: the source URL, the wording shown at the moment of collection, the timestamp and the IP. That standard eliminates most of what is sold as list rental, and it is why this engagement opens with an audit that sometimes ends the engagement. We charge for that audit and we have written the report that says do not do this more than once. The evidence standard: A supplier's assurance that names are opt-in is not evidence, it is a sentence. We ask for the collection page as rendered, the checkbox state, the partner disclosure, and a sample of records with their individual provenance. Where the source is a sweepstakes, a gated download, a quiz funnel or a scraped professional directory, we stop there regardless of price or volume, because those files do not fail slowly; they fail as complaints inside the first two sends and the damage lands on a domain you cannot replace. Co-registration specifically: The partner's checkbox must name you at the point of collection, unchecked, and the record must include the rendered page as the user saw it. A clause covering partners and selected third parties is not consent for you, and we will not send against it. Under GDPR that construction fails outright, so European co-registration is either named-partner or it does not happen. US law is more permissive here, and it does not matter much: Gmail's complaint threshold enforces what the statute does not, and a file that reaches 0.30 percent complaints has ended the argument about legality by other means. The sending identity is separate, always: Rented and co-registered volume goes out on its own subdomain, its own IP pool, its own ESP sub-account and its own DMARC record set to reject. Your primary domain is never the test surface. The cohort is quarantined until it holds a Gmail complaint rate under 0.10 percent across a full warm-up, against Google's published bulk-sender line of 0.30 percent in force since February 2024. A name that has not clicked by the end of the second send is suppressed permanently and never recycled into a later reactivation, which is the single practice that separates this from the version of the work that burns a domain in a quarter. How the programme is designed to end: A rented cohort is a bridge to a relationship you own, not a channel. The measure is the share of names that give you their own consent within 60 days; everything else is rented traffic you are paying to address twice. We write an end date into the scope, and at that date the sending identity is retired rather than repurposed. If the conversion to first-party consent is not there by the second cohort, the recommendation is to stop, and we will make it in writing. Where we decline outright: Patient lists and any health-inferred file from a rented source, which is special category data under GDPR Article 9 and is not made lawful by a broker's paperwork. HCP files without verifiable matching and a named original source. Candidate sourcing files presented as marketing lists, since applying to a job is not consent to be marketed to and scraped professional addresses have no consent record by construction. Any arrangement where the supplier will not let you contact one named recipient's record on request. Not included: Buying the data, which stays a direct contract between you and the supplier. Legal sign-off. Deliverability remediation on a primary domain already in filtering, which is a different engagement and has to happen before this one, not alongside it. Not for you if: You need volume this quarter and the audit is the obstacle between you and it. Or you are looking for a supplier who will hold the consent risk on your behalf; nobody credible does, and an agency that says it will has told you how carefully it reads.