Marketing Consent: What It Is and How a Shop Records It
By Alva Chew · Updated
Definition Marketing consent is a customer's permission for you to use their contact details to send promotions. Rules differ by country. Singapore's PDPA generally requires consent and an easy way to withdraw it, while the US CAN-SPAM Act requires an opt-out rather than prior consent. A loyalty programme needs an email to run points, and that does not by itself give you permission to market.
What is marketing consent?
Marketing consent is a customer’s permission for you to contact them with promotions, using details such as an email address or phone number. It covers messages about offers, new products and events. It does not cover a receipt or a message about a customer’s own points balance.
Two things are easy to mix up. A customer gives you an email so you can run their account. That is one purpose. Using the same email to send a weekly offer is another purpose, and in many places it needs its own permission.
What counts as valid consent?
It depends on the country. Singapore’s Personal Data Protection Act (PDPA) is built around consent, and the Personal Data Protection Commission (PDPC) sets out what makes it valid.
- An organisation providing a product or service must not, as a condition of providing it, require consent beyond what is reasonable to provide that product or service (section 14(2)).
- Consent obtained by false or misleading information is not valid. PDPC lists purposes stated in vague terms, in an illegible font or in an obscure part of a document as examples of misleading practice.
- Consent can be deemed when a customer voluntarily provides data for an obvious purpose, such as handing over a card to pay.
- Organisations may ask for consent for extra purposes, as long as they do not make it a condition of the product or service.
Source: PDPC, Advisory Guidelines on Key Concepts in the PDPA, revised 29 April 2026.
Is consent the same everywhere?
No. The US takes a different route for email.
| Rule | Singapore PDPA | US CAN-SPAM Act |
|---|---|---|
| Starting point | Consent for the purpose, which may be deemed in some cases | No prior consent needed for general marketing email |
| Customer’s control | May withdraw consent at any time | Must be told how to opt out of future marketing email |
| Timing | PDPC treats at least 10 business days as reasonable notice | Honour an opt-out within 10 business days |
| Penalty figure | Up to S$1 million or 10% of Singapore turnover above S$10 million, see PDPA page | Up to US$53,088 per violating email |
Sources: PDPC guidelines above, Section on withdrawal. FTC, CAN-SPAM Act: A Compliance Guide for Business, on ftc.gov, which says the figure was updated in January 2024 for inflation.
Other regions have their own rules. We did not verify the EU or UK texts for this page, so check them if you serve customers there.
How does withdrawal work?
Under section 16 of the PDPA, an individual may withdraw consent at any time by giving reasonable notice. On receiving the notice, you must tell the person the likely consequences. You must not prohibit the withdrawal. Once consent is withdrawn, you must stop collecting, using or disclosing the data unless a law requires or authorises it.
PDPC advises a clear, easily accessible withdrawal policy. It also says individuals must be able to withdraw consent for optional purposes without withdrawing consent for the necessary ones. A member can stop your promotions and still keep earning points.
What should a shop keep on record?
Neither source above sets out a record format for a shop, so this is a practical habit, not a rule from them. Keep four things for each customer who agrees to marketing:
- Who agreed, by name or email.
- The date and where it happened, for example at the counter or on a sign-up page.
- What they agreed to, in the words you showed them.
- How they can withdraw, and the date if they do.
How does a points programme keep consent simple?
A points-based programme needs little to run: an email and a purchase record. That is the first-party data you collect for the account. Keeping marketing permission as a separate, optional choice means a member who says no still earns and redeems points. Our guide to loyalty programs and the PDPA goes through sign-up and withdrawal for Singapore.
This page is a plain-language summary and not legal advice.
How Gimify fits
Gimify members join through a QR code with an email address, with no app or form, and their card lives in Google Wallet. Gimify does not run SMS or email marketing campaigns, so any promotions you send to members are your own, and the rules above apply to them.
Questions owners ask
What is marketing consent?
A customer's permission for you to use their contact details, such as an email address or phone number, to send promotions. It is separate from the details they give you to run an account or deliver a purchase.
Does joining a loyalty programme mean a customer agreed to marketing?
Not automatically. Under Singapore's PDPA, an organisation may not require consent beyond what is reasonable to provide the product or service as a condition of providing it. Check the rules where your customers live.
Is consent the same everywhere?
No. The PDPA in Singapore is built around consent. The US CAN-SPAM Act does not require prior consent for general marketing email but requires an opt-out. Check your own country's rules.
How fast must I honour an opt-out?
The FTC's CAN-SPAM guide says you must honour an opt-out request within 10 business days. PDPC treats at least 10 business days as reasonable notice for a PDPA withdrawal.
What should I keep on record?
Note who agreed, when, what they agreed to and how they can withdraw. A short record lets you answer a customer or a regulator without guessing.
Read next
Start free
Gimify is free for one outlet with unlimited members and no time limit. Unlimited outlets are one flat monthly price.
See plans