Marketing Consent in 2026: What Needs Opt-In, What Stays Opt-Out, and What to Prove

If you are reviewing marketing consent on August 9, 2026, the first thing to drop is the idea that one checkbox solves it.

The real question is always narrower. Is this email, SMS, cookies, retargeting, or a California sale-or-sharing opt-out? Is the message promotional, transactional, or part of an existing customer relationship? Are you relying on your own collection point, a soft opt-in exception, or a third-party list you inherited from somewhere else?

Official guidance in 2026 keeps pushing teams toward that more exact framing. The European Commission still says valid consent must be freely given, informed, specific, and based on a clear affirmative act, and it still says withdrawal must stay easy. The UK ICO updated its electronic-mail marketing guidance on April 28, 2026 and added the new charitable soft opt-in that commenced on February 5, 2026. France’s CNIL published updated guidance on June 10, 2026 stressing that the rules depend first on the nature of the message and that electronic prospecting to individuals rests, in principle, on prior consent. In the United States, the FTC still treats most commercial email under CAN-SPAM as an opt-out regime, while the FCC’s current TCPA materials keep robotext and robocall consent stricter. California remains its own lane again, with current CCPA and CPPA regulations effective on January 1, 2026 and a live requirement to honor Global Privacy Control where sale or sharing is in scope.

If you want the closest companion reads first, start with our guides to GDPR marketing consent, opt-in consent, and cookie consent requirements. This article stays broader. It is the practical map for marketing consent across the main channels teams mix together by mistake.

What marketing consent actually means now

The fastest way to clean this up is to separate five different questions:

1. Do you need prior consent before sending the message?
2. If not, do you still need a clear opt-out?
3. Does the rule change if the person is an individual, a business contact, or an existing customer?
4. Does the same choice cover downstream advertising or tracking?
5. Can you prove what the person saw, chose, and later changed?

Most mistakes happen because a team answers only the first question.

That is how businesses end up with a newsletter signup that quietly feeds SMS, ad audiences, partner sharing, and website tracking. The interface may look efficient, but the legal model underneath it is fragmented. The Commission’s current GDPR guidance is still clear that consent has to be specific to the purpose. The CNIL’s June 2026 marketing guidance starts with the same discipline from a different angle: first identify the nature of the communication, because promotional, transactional, and relational messages do not follow the same rule set.

1. Email marketing is not one global consent model

For EU and UK outreach to individuals, prior consent is often still the baseline for promotional email and text, subject to limited exceptions. The ICO’s updated direct-marketing guidance says the new charitable soft opt-in only began on February 5, 2026, and it can be used only if the organization meets the stated conditions. The older products-and-services soft opt-in remains narrow too. It does not excuse vague wording, unrelated promotions, or weak refusal paths.

The enforcement message got sharper on January 20, 2026. The ICO announced GBP225,000 in fines against two companies for unlawful marketing messages, including more than 67 million marketing emails sent without valid consent using third-party data where people were not given clear and informed choices. That is a useful reminder that marketing consent problems often come from inherited lists and bundled partner language, not only from your own form design.

For U.S. commercial email, the rule is different. The FTC’s CAN-SPAM guidance still does not create a universal advance opt-in requirement for marketing email. Instead, it requires accurate identification, a clear unsubscribe path, and honoring opt-out requests within 10 business days. So when teams say they have “marketing consent” for U.S. email, what they often really mean is that they have a deliverable address and a compliant suppression workflow. Those are not the same thing.

2. SMS and robocall consent is usually stricter than email

This is another place where teams overgeneralize.

FCC materials implementing the TCPA now make two operational points especially important. First, the National Do-Not-Call Registry protections extend to text messages. Second, where prior express written consent is required for telemarketing robocalls or robotexts, the consent must be one-to-one, tied to a single seller, and logically associated with the interaction where it was collected.

That means a shared lead-gen page with dozens of buried partners is a poor foundation for marketing consent in SMS. It also means that a general “contact me about offers” clause may be nowhere near enough if the campaign is actually driven by automated telemarketing text workflows.

If email, SMS, and calling all sit under one CRM toggle in your stack, the safe assumption is not that the toggle is elegant. It is that the toggle is hiding work you still need to split.

3. Cookie and ad consent should not be disguised as channel consent

A person agreeing to receive a newsletter is not automatically agreeing to analytics cookies, ad measurement, retargeting, or sharing data into audience pipelines.

That sounds obvious, but it is still where a lot of modern marketing consent design breaks. The European Commission’s current materials say consent must be specific to the purpose and given through a clear affirmative act. The same page also says:

“It should be as easy to withdraw as to give consent.”

>

European Commission

If your marketing stack treats one lead form as permission for email nurture, website tracking, audience enrichment, and ad targeting, the specificity requirement starts to fray quickly.

In California, the question is often different again. The Department of Justice’s GPC page describes the signal as a:

“stop selling or sharing my data switch”

>

California Department of Justice

That is not the same legal task as obtaining EU-style prior consent for non-essential cookies. A California visitor may be exercising an opt-out right tied to sale or sharing. An EU or UK visitor may be deciding whether optional tracking can start at all. The button may look similar, but the compliance logic is not.

4. Third-party lists and partner language are still one of the biggest failure points

The January 2026 ICO case is useful because it does not read like a fringe edge case. It reads like a familiar growth workflow.

One company relied on third-party signup data tied to a long list of 361 partner companies without a genuine mechanism for people to choose which organizations could contact them. The ICO found that this did not create informed, specific consent. That is a strong warning for affiliate, comparison-site, and co-registration models that still rely on broad partner wording.

The European Commission’s current direct-marketing materials land in a similar place. If you acquire personal data from another organization and want to use consent as the basis for your own direct marketing, you need to be able to show that the original consent covered transmission to other recipients for their own advertising. If the record only shows that someone agreed to hear from “selected partners,” you may not have the proof you think you have.

The practical rule is simple: if your team cannot identify the exact source page, wording, seller or sender, date, and purpose tied to the record, do not assume you have defensible marketing consent.

5. Good proof has to survive the whole downstream workflow

The proof standard in 2026 is not just a yes-or-no field in a CRM.

For high-confidence records, teams should usually be able to show:

• the exact wording presented at collection;
• the date, time, and collection source;
• the channel involved, such as email, SMS, or cookies;
• the purpose involved, such as newsletters, promotions, partner marketing, or retargeting;
• whether a soft opt-in exception, not consent, is the real legal basis;
• any later withdrawal, suppression, or GPC-triggered change;
• and where the record was propagated after capture.

That last point matters because most marketing consent failures do not start at the form. They start later. A suppression list does not sync. A preference center updates email but not SMS. A California opt-out stops one audience export but not another. A banner disables one tag but not the server-side enrichment flow behind it.

When the evidence only works inside one tool, it is not really evidence of the live customer journey.

A fast review before you launch anything

Before approving a campaign, a new form, or a new vendor flow, run this quick sequence:

1. Name the exact channel: email, SMS, cookies, ad sharing, or something else.
2. Name the exact purpose: newsletter, promotion, partner offer, audience building, retargeting, or transactional support.
3. Confirm whether the rule is prior consent, soft opt-in, or opt-out.
4. Check whether the same record is being stretched into a second purpose it never actually covered.
5. Test withdrawal or opt-out in the live stack, not only in the collection form.
6. Verify the proof trail before the campaign goes out, not after complaints arrive.

That review catches more real issues than another debate about whether the checkbox label should say agree, opt in, or stay informed.

Bottom line

The safest definition of marketing consent in 2026 is not “the user said yes once.” It is “the business can explain which channel, which purpose, which legal model, and which proof record applies, then show that the live systems still respect it.”

That usually means more separation, not less. Separate email from SMS. Separate outreach from tracking. Separate EU or UK prior-consent logic from California opt-out logic. Separate genuine first-party proof from inherited partner-list assumptions.

If you do that, the consent model gets easier to understand and easier to defend. If you do not, the marketing workflow may look streamlined while the legal basis underneath it is still mixed together.

Sources

• European Commission: Legal grounds for processing data
• European Commission: When is consent valid?
• UK ICO: Guidance on direct marketing using electronic mail
• UK ICO: Charities given new flexibility to contact supporters under data law change
• UK ICO: Fines of GBP225,000 for nuisance marketing messages
• CNIL: Communications par voie électronique aux prospects et clients : quelles règles respecter ?
• FTC: CAN-SPAM Act: A Compliance Guide for Business
• FCC: Small Entity Compliance Guide on Targeting and Eliminating Unlawful Text Messages
• California Department of Justice: Global Privacy Control (GPC)
• California Privacy Protection Agency: Law & Regulations

This post was updated on August 9, 2026 using current official regulator and government materials available at publication time.