Slip 6 · Proving permission
Keeping consent records
The ACMA says to keep a record when a person gives express consent, including who gave it, when and how, because under the Spam Act it is up to you to prove that you have a person’s consent. Its statement of expectations adds two more details: the terms that applied, and the time as well as the date.
General information, not legal advice. The ACMA’s Avoid sending spam page and its statement of expectations on consent are the places to check. The statement describes itself as a guide to better practice, not a definitive compliance guide.
What a record holds
The drawing below lays out, as an illustration, a blank record with the details the ACMA names. The layout is this guide’s; the first four fields come from the ACMA, and the fifth is marked as this guide’s own suggestion.
- Who gave itThe person who consented.
- WhenThe date and the time it was obtained.
- HowThe method: a form, a website tick box, a phone call or face to face.
- The terms that appliedThe wording the person saw or heard when they agreed.
- Withdrawn (this guide’s addition)When an unsubscribe or withdrawal arrived, and when it was actioned.
Why keep the terms? The ACMA expects consent terms to cover what the consent is for, who will use it, how long it will be used and how it can be withdrawn, and to be readily accessible where consent is given. In this guide’s reading, a record of a tick without the words beside it shows that something was agreed but not what. The withdrawal field is suggested for a similar reason: the Spam Act’s 5-working-day limit for honouring an unsubscribe is easier to show with a date on each side.
Records kept by someone else
If an agency, an affiliate or a list provider gathers the consent, the ACMA tells businesses not to assume those third parties will keep or obtain records of consent and marketing. It expects oversight and assurance processes so the records are reliably kept, whether by the third party or by the business itself, and if the ACMA requires them using its compulsory information-gathering powers, they must be produced.
Consent that runs out
- Telemarketing. Express consent to calls that was not given for a set period, or indefinitely, is taken to expire three months after it was given.
- Stale consent generally. The ACMA expects businesses not to use consent that is so old the person would not expect it to still apply.
- Privacy. Where APP 7 applies and consent was obtained at collection, the OAIC says the organisation must be satisfied the consent is still current when it later uses or discloses the information.
Consent that ends
An unsubscribe request has to be honoured within 5 working days. For calls, inferred consent ends immediately once a person says they do not want to receive them. The ACMA’s statement lists three related practices that will generally not meet its expectations:
- Messaging an address after an unsubscribe because someone else uses it: the request applies to the address, whoever uses it
- Re-contacting people who unsubscribed to encourage them to resubscribe, unless they have since consented
- An unsubscribe that covers only some kinds of message, unless a universal unsubscribe is also offered and each option is clear
A second tick
Among its consumer-friendly practices, the ACMA suggests considering a double opt-in: a confirmation, such as an email, that consent has been given, possibly linking to a page where the person can manage their preferences. It is a suggestion, not a rule in the Act, and it also leaves a second dated entry for the record.