ModeesConsent is not a checkbox. It is a decision by a person, made at a moment, in response to specific words, with a clear way to change their mind. The record is the evidence of that decision. If the evidence is missing, the consent is missing — even if the person genuinely did agree.
This article describes the fields and the process. It is not legal advice, and the rules differ outside the UK and EU; use it as a checklist for a conversation with your adviser.
The standard being tested
Under UK GDPR, consent must be freely given, specific, informed and unambiguous. Silence, pre-ticked boxes and inactivity do not count. The person must be able to withdraw as easily as they agreed, and they must know who is asking and what for.
Under PECR, electronic marketing needs consent unless an exception applies. The main exception for email is the soft opt-in — an existing customer, during a sale, with an easy opt-out — and the corporate-subscriber distinction for B2B. Those are covered in PECR and B2B email.
The fields
For each contact, store:
- The email address as entered, plus the normalised version you will send to.
- Consent status — opted in, soft opt-in, legitimate interest, refused, withdrawn — with the date of the current status.
- The exact wording the person agreed to, in full. Not "marketing consent" — the sentence they saw, including the brand name and the channel.
- The source — which form, page, URL, event or import, with a source identifier.
- The timestamp, with timezone.
- The method — single opt-in, double opt-in, paper form, in-person.
- The scope — which brands, which types of message, which frequency if you promised one.
- Withdrawal date and mechanism, when it happens.
- The evidence — the confirmation email for double opt-in, the IP and user agent for a web form, the import file for a list.
- The version of the privacy notice in force at the time.
The last two are the ones most systems omit. Wording changes; a record that names only the current version cannot prove what was shown last year.