Skip to content

ADR 0007: Consent ledger and verified-only sending

  • Status: Accepted
  • Date: 2026-09-11

Context

Newsletter consent must be provable (GDPR), topic-granular, and shared by several signup surfaces (website banner, demo shops, teaser forms). Marketing email to unverified or unsubscribed addresses is both illegal and reputation-burning.

Decision

Consent is an append only ledger: every grant and withdrawal is a new marketing_consents row with topic, source, IP and timestamp; current state is the latest row per topic, rows are never edited. An address is verified only when its owner clicks the emailed token link. The one legitimate audience query is MarketingContact.sendable(topic): verified, and topic granted by the latest row. The welcome voucher hangs off the same machinery: issued on verification, percentage from subscribed breadth, voided the moment the newsletter is cancelled.

Consequences

Evidence for every consent question, replayable history, and a hard guarantee that no send list can contain an unverified address. GDPR erasure deletes the contact and its whole ledger in one straight delete.