Basis: the October 2026 decisions on Xandr (Norway), political-interest targeting (Berlin) and automated credit decisions (EU Advocate General opinion), and MarTech’s note that an opt-in click “tells you a customer agreed to legal terms” but not their interests, frequency or channels. This is not legal advice.
Consent
- Do you collect any special category data (health, sexual orientation, political opinion)? If so, is explicit consent recorded?
- For data you receive from partners, can you show that consent was verified, not assumed? The Xandr decision turned on this.
- Is consent as easy to withdraw as to give?
Preferences
- Can customers choose topics, channels and frequency?
- Do your automations read those choices before sending?
- Is there a way to pause, not only unsubscribe?
Automated decisions
- List decisions made only by automated scoring (credit, payment options, eligibility) and what data they use.
- Can you explain the data and logic used?