CRM consent management: by channel and by purpose
A single "consent" box cannot show that a customer agreed to order updates on WhatsApp but not to promotions. This guide builds a practical consent management model in the CRM: channel, purpose, status, date and evidence, service versus marketing messages, obtaining consent, spreading opt-outs to every system, importing an old database and retention.
Short answer
Customer consent in a CRM is not managed with a single yes/no box. Every consent should be recorded on three dimensions: which channel (WhatsApp, SMS, email, call), which purpose (service notification, marketing) and evidence — when, where and with what wording it was obtained. An opt-out must spread immediately to every channel and every system that takes data from the CRM. This article shows a practical record model; legal requirements vary by country and must be checked with a lawyer for your jurisdiction.
Why one box is not enough
A customer agrees to get order status on WhatsApp but does not want promotions. Another agrees to an email newsletter but not to calls. A "consent: yes" box loses these differences and leads to one of two mistakes: either the company sends a message it had no permission for, or out of caution it does not send a service notification it was allowed to send.
Channels have their own rules too. Meta, for example, requires businesses to obtain clear opt-in before messaging people on WhatsApp, to explain how to opt out of specific message types and to honour opt-outs, and it recommends collecting opt-in by category.
A consent record model
On each customer record, consent consists of separate rows. Each row has:
- ChannelWhatsApp, SMS, email, call, Instagram DM.
- PurposeService (order, appointment, payment) or marketing (offers, campaigns).
- StatusGiven, withdrawn, not asked.
- DateThe day the status last changed.
- Source and wordingWhere it was obtained (website form, chat, shop) and what text the customer saw.
Service versus marketing messages
A service message relates to a specific transaction: an order confirmation, an appointment reminder, a payment receipt. A marketing message offers a new sale. Mixing the two in one message — adding a discount to the end of a reminder — can turn it into marketing. On WhatsApp the distinction also shows in the template category, which Meta decides. The reminder flow itself is covered in the appointment reminder workflow.
Where and how to obtain consent
- Website form: a separate, unticked option whose wording names the channel and purpose.
- Chat: the customer is asked and the answer stays in the conversation — that is the evidence.
- Shop or office: consent on paper or a tablet is copied into the CRM with date and source.
- Call: if consent is asked during the call, the recording or the agent's note serves as evidence.
In every case, the customer must clearly understand which business will contact them and with what kind of message.
An opt-out must reach every system
A customer writes "STOP" on WhatsApp, yet the next day an email campaign reaches them and a week later a call campaign. The cause: the opt-out was recorded in one channel and the other systems cannot see it. The rule: an opt-out is recorded centrally in the CRM, and every system that takes lists from the CRM — the email service, the call campaign, the ad audience — checks it before the next send.
Deleting an opted-out customer is not the answer: they may be imported again later with another list. The opt-out record is kept so it is recognised at the next import.
When importing an old database
Old Excel lists are the biggest source of consent problems. Before importing, ask three questions: on which channel and for what did these people consent, is there evidence, and are there people who opted out before? Rows without evidence are imported as "not asked" and excluded from marketing sends. General migration rules are also covered in CRM duplicate records.
Retention and deletion
A consent record lives with the customer's data. When a customer asks for their data to be deleted, the record and conversations are deleted, but discuss with a lawyer how you will protect the opt-out itself against re-import — some legal systems require or allow keeping a minimal suppression record. Retention periods differ by country and sector.
Who is responsible
Consent gets lost between three departments: marketing sends, sales calls, and legal knows the rules. So roles must be written down. Legal or an outside adviser approves the consent wording and the retention rule. The CRM admin builds the record model and checks imports. Marketing confirms before every send that the list has passed the consent filter. Sales and support record consent or an opt-out given in conversation straight away. Once a quarter, run a short check: can evidence of consent be found on 20 random records?
An illustrative example
This is an illustrative example. A cosmetics shop wants to load an 8,000-number legacy list into its CRM. A check shows that half of it was collected at the till for a "discount card" with no consent wording. Those rows are imported as "not asked".
At the next purchase, the cashier asks: "May we message you on WhatsApp about new products?" The answer goes into the CRM with channel, purpose, date and the "shop" source. Three months later the marketing list is smaller, but every row has evidence.
Common mistakes
- One general "consent" box.
- A pre-ticked consent field.
- Importing an old database as "consent given".
- Recording an opt-out in only one channel.
- Adding promotions to service reminders.
Limitations
This article is not legal advice. Consent requirements — which messages need it, how it must be obtained, how long it is kept — differ by country, sector and channel, and they change. A CRM record only helps the process be set up correctly; no system ensures legal compliance automatically.
Consent data in Vexvon
Vexvon connects to WhatsApp only through the official Business API and sends template messages under Meta's rules. On the customer record, the company can create its own tags and extra fields — consent fields are set up this way — and conversations stay in the record's timeline, so the wording of a consent obtained in chat remains visible. According to Vexvon's security page, data is kept until an authorised user deletes it, and a shorter period can be set in the contract. More on security.
Next step
List the consent fields in your CRM and ask three questions of each: is the channel separate, is the purpose separate, is evidence recorded? Consent for call recording is a separate topic — see call recording, consent and retention. More articles are in the AI CRM section, and we can review your model together during a demo.