Email Marketing · Platform Migration

How to Audit Email Consent Records Before Importing Contacts

Learn what consent evidence to preserve before moving an email list, how to handle incomplete records, and how to avoid treating every contact as permission to market.

Moving to a new email marketing platform is a data, process, and measurement change—not merely a software switch. This guide explains how to approach the task, what to verify, and how to document the result. Adapt the checks to your provider, business model, and the laws that apply to your subscribers.

A contact record is not consent

An email address in a CRM, purchase database, spreadsheet, or event list does not automatically establish permission for every marketing message. Consent requirements vary by jurisdiction and context. Before migration, identify the legal basis and operational permission used for each audience rather than assuming that historical possession of an address is enough.

Identify the source of each record

Record how each address was collected: website signup, checkout, event registration, customer account, partner referral, or manual entry. Include the form or process name and, where possible, the URL or campaign that collected it. A vague source such as “website” is less useful than a specific form and collection date.

Preserve the wording shown at signup

Where available, retain the consent statement, checkbox labels, privacy notice version, and whether a checkbox was preselected. The wording helps establish what the person was told and what they agreed to receive. Do not reconstruct missing consent wording from memory or assume that a current form matches an older version.

Keep timestamps and context

Preserve signup date and time, time zone if known, source system, form identifier, and any confirmation event such as double opt-in. Store the data in a format that remains interpretable after import. If the source platform exports only a date or a generic status, document that limitation.

Separate marketing permission from customer status

A customer, trial user, webinar attendee, or downloaded-lead contact may have a business relationship without having agreed to every promotional email. Map each audience to the purpose and message category it was collected for. Avoid converting transactional or service contact data into a general newsletter audience without a valid basis.

Handle incomplete and conflicting records

Create an exception group for contacts with missing source, unclear permission, conflicting timestamps, or an unsubscribe history. Do not silently mark these records as opted in. Decide whether to exclude them, seek fresh permission through an appropriate channel, or obtain legal advice for the relevant market.

Map fields before import

Create a field mapping sheet for email address, consent status, source, timestamp, form ID, consent text version, confirmation status, and suppression status. Test the mapping with a small sample. Avoid placing sensitive free-text notes into fields that may later be exposed to campaign users.

Use double opt-in thoughtfully

Double opt-in can provide evidence that a person controlled the submitted address, but it is not a universal substitute for all legal requirements. Confirm that the confirmation process records the request and confirmation event, and that unconfirmed addresses are not treated as fully subscribed where your process requires confirmation.

Document the audit outcome

Report how many records have complete evidence, partial evidence, and unresolved status. State the rules used for inclusion and exclusion. Keep source exports and audit files securely, restrict access, and follow applicable retention requirements. For cross-border lists, obtain qualified legal advice about the relevant jurisdictions.

Practical review checklist

Record the source system, destination setting, owner, and test evidence.
Use controlled test contacts rather than real subscribers for experiments.
Resolve consent, suppression, and authentication issues before activating campaigns.
Document exceptions and obtain approval for material differences.
Repeat critical tests after configuration or integration changes.

Common mistakes to avoid

Do not assume that a successful import proves that permissions, preferences, automation logic, and tracking were preserved. Do not compare platform metrics without checking their definitions. Avoid making several configuration changes at once, because that makes failures harder to isolate. If a test exposes a material risk, pause the affected send or workflow until it is corrected.

Related resources

Conclusion

A reliable migration is demonstrated by tested behavior and traceable evidence. Use a documented checklist, preserve the records needed to protect subscribers, and monitor the first campaigns carefully. Revisit the process whenever your sending systems, forms, or data flows change.