Question

A retail company relies on customer consent as the legal basis for its email marketing program. During a privacy program review, the privacy engineer discovers that while customers can grant consent easily during checkout, there is no straightforward way for them to withdraw that consent later, and marketing continues until a customer files a formal complaint. Which action best aligns the program with core privacy principles governing consent?

Accepted Answer

Implement a consent management capability that makes withdrawing consent as easy as giving it, and ceases processing upon withdrawal

Answer

Add a clause to the privacy notice stating that customers must submit a written request to unsubscribe from marketing

Answer

Switch the legal basis for marketing from consent to legitimate interest to avoid managing withdrawals

Answer

Require customers to re-confirm consent annually so stale consents automatically expire