From:

Howdy everyone I'm actively tackling the GDPR monster It's a big issue, and I'm taking it very seriously I know some of you have questions about GDPR and Dada Mail Boy do I have some too

Right now, I'm working on the "record of consent" part of all this, and also just what constituted "consent"

So good part:

Dada Mail, since way back in the day, has kept records on things like requests to subscribe, confirming subscriptions, unsubscriptions - stuff like that That information can be teased into a better format, so that it's documented a little nicer I can write something that migrates that data over really easily That way, when people request this data, you can show it to them Easy!

So, if you're running a closed-loop opt-in mailing list (rather than just subscribing someone straight up WITHOUT confirmation), you're probably in a good place I think The idea of, "consent" is not an easy pill to swallow

What I'm trying to figure out is, if clicking the confirmation link in the confirmation email is enough "consent" under GDPR If so, things will be pretty easy in this brave new world! If not, it's going to be a little tougher, unfortunately

Any opinions about that, out there?

Unfortunately, I'm not a lawyer, and don't have a hot-shot legal team, myself :(

Right at this moment I'm reading this (although I've read more on GDPR than what's in the Simulacrum, that's for sure!)

https://litmus
com/blog/5-things-you-must-know-about-email-consent-under-gdpr

Where they give an example of granting consent with a double-opt-in form (that's the same as what I'm calling closed-loop opt-in)

Moving forward, it would behoove us to have a checkbox for each of the specific things that we'd like our subscribers to grant "consent" for To speed this along, this may be something pretty simple like,

"I give my consent to occasionally email me with news and announcements about your business" (link to privacy policy)

(roughly) and then allow customization per list from there (of course this initial one CAN be customized, as well)

Removing consent is basically unsubscribing from a list So that one's easy, too The change for unsubscription is the option to unsubscribe from ALL mailing lists at the same time

Some bad news:

Profile field information is one of those things that really needs consent on what you're going to do with it So, to be GDPR clean, you can't use them For anything That may affect some/a lot of people

Things like using email addresses for tracking purposes is another thing you'll need consent for (I think?) So, I'll be disabling that on new mailing lists I can't see a problem with tracking anonymous data, so we can still do that, I guess!

Anyways, just a start Floor is open for more questions/answers/discussion

Please, feel free!