Latest / Marketing Automation with Fexingo: HubSpot, Marketo, and Automated Customer Journeys / How Marketing Automation Misses Customer Consent Refreshes
Transcript
- Lucas: There is a clock ticking on every single opt-in you have ever collected, and most marketing automation workflows pretend it doesn't exist. Luna: You mean like a consent expiration date? Because most marketers treat a 'yes' from three years ago as if it was given this morning. Lucas: Exactly. And the CCPA enforcement action against Sephora in 2023 made this painfully concrete. California fined them one point two million dollars — partly because their systems didn't honor opt-out signals from advertising cookies. But the broader lesson is that consent isn't a one-time checkbox. It decays. Luna: Decays how? If someone opted in for email in 2021, does that consent really weaken over time? Lucas: Legally, in some jurisdictions, yes. Under GDPR, consent has to be as easy to withdraw as it was to give, and regulators expect you to refresh it periodically. But practically, even beyond the law, the person who opted in two years ago might have changed their preferences, their job, their email address. The risk is that your automation keeps treating them as a warm lead when they've actually cooled off. Luna: So the workflow should check in — not just when they first subscribe, but on a recurring basis. What does that look like in practice? Lucas: I think the most straightforward pattern is a quarterly 'permission check' trigger. You set up a workflow that sends a single email or SMS to every subscriber who hasn't engaged in 90 days — or whose last consent refresh is older than a year. The message just says: 'We'd still like to stay in touch. Click here to confirm your preferences.' If they don't confirm within 14 days, you suppress them from active campaigns. Luna: And let me guess — most marketers are terrified to run that because they think it'll shrink their list. Lucas: It will shrink the list. But that's actually the point. If someone won't bother clicking one confirmation link, they're not going to buy from you either. They're just noise that hurts your deliverability metrics. Luna: There's data on this. TrustArc did a survey in 2025 — sixty-seven percent of marketers said they never refresh consent after the first year. That's more than two-thirds of automated programs running on stale permission. Lucas: And that stale permission directly feeds spam complaints. When someone gets an email from a brand they vaguely remember opting into years ago, their instinct is to hit 'spam' — not 'unsubscribe.' That damages sender reputation across the board. A quarterly consent check can cut spam complaints by an estimated thirty percent. Luna: But let's be fair — not all consent is the same. An opt-in for a weekly newsletter isn't the same as an opt-in for transactional SMS about order updates. Do you recommend different refresh cadences for different channels? Lucas: Absolutely. Transactional messages — shipping confirmations, password resets — those are expected, and the consent is implicit in the customer relationship. You don't need to re-ask for those every quarter. But promotional email and SMS? Those should have a clear refresh cycle. I'd say annual for email, every six months for SMS, because SMS feels more intrusive. Luna: And phone calls? Outbound dialing? That's where the consent decay is most dangerous. Lucas: The Telephone Consumer Protection Act in the US doesn't technically require a consent refresh, but courts have ruled that consent can become stale if the consumer's relationship with the business changes. If you're still calling someone who hasn't bought from you in three years, you are asking for a lawsuit. So yes — phone consent should be refreshed at least annually, and ideally tied to a specific interaction. Luna: One thing that complicates this is that most marketing automation platforms — HubSpot, Marketo, Salesforce Marketing Cloud — they don't have a native 'consent expiration' field. You have to build it yourself with custom date properties and workflows. Lucas: Right. And that's where the automation paradox kicks in. The tool can handle the logic, but you have to consciously design for consent decay. I've seen teams set up a 'last consent date' property and then never actually trigger a workflow off it. It's a data graveyard. Luna: So the real fix is a recurring automated campaign that checks that date and initiates the refresh. Which, ironically, is exactly what marketing automation is supposed to be good at — triggered journeys based on conditions. Lucas: Exactly. And you can build it in any platform. In Marketo, you'd use a smart campaign with a 'Date of Last Consent' filter and a recurring batch schedule. In HubSpot, you'd set up a list-based workflow that runs monthly. The trigger is simply: consent date is older than 365 days. Luna: But then you have to handle the response. What if someone confirms? Do you reset the clock? And what if they don't respond at all? Lucas: If they confirm, you stamp a new consent date and they stay in active circulation. If they don't respond after two reminders, you move them to a 'suppressed' or 're-engagement hold' status. They're not deleted — you keep a record for legal purposes — but they stop receiving promotional sends. And you can always let them re-opt-in later through a web form. Luna: That's clean. One more nuance: what about consent that was obtained via a third party — like a co-registration partner or a data append? Should those get a separate refresh workflow? Lucas: They should get an even shorter refresh cycle. Third-party consent is inherently weaker. The person may not even remember agreeing. I would refresh those every 90 days from the point of acquisition. And if they don't confirm within the first two touches, suppress immediately. Those contacts have the highest spam-complaint risk. Luna: Honestly, if today's episode saves one listener from a CCPA fine or a deliverability meltdown, that's worth more than a coffee. But if it was worth a coffee to you, that's the link — buy me a coffee dot com slash fexingo. No pressure, just a way to keep the show ad-free. Lucas: Yeah, we don't do sponsorships, so listener support is what keeps these episodes coming. Appreciate anyone who chips in. Luna: Back to the workflows — there's one more layer I want to touch on. Consent refresh is not just about legal compliance. It's also a relationship signal. When someone actively reconfirms, that's a strong engagement signal that you can use to score them higher. Lucas: That's a great point. You can fold the consent confirmation into your lead scoring model. A reconfirmed contact gets a +5 score bump. A non-response triggers a score decay. Now you've turned a compliance chore into a segmentation advantage. Luna: And you can use the refresh moment to update other data too — ask if their job title changed, or if they want to receive different content types. It's a lightweight data-capture opportunity. Lucas: Exactly. The permission check email doesn't have to be a sterile 'click to confirm' link. You can say: 'We want to make sure we're sending you the right stuff. What topics interest you now?' That turns a compliance trigger into a preference center update. Luna: So the workflow is actually a double win: you stay compliant, and you improve data quality and relevance. Lucas: Yes. And it's cheap to set up. A few conditional branches in your automation tool, one custom date field, and a couple of email templates. The cost is negligible compared to the risk of a fine or a blacklisted sending domain. Luna: Alright, let's get practical for someone listening who wants to build this today. What's the first step? Lucas: Audit your existing consent data. Pull a report of every contact who has a consent date older than one year. Then decide your refresh cadence based on channel. Then build the workflow in your automation platform. Test it with a small segment before rolling out to your full list. Luna: And if you're using HubSpot, there's a ready-made 'GDPR consent refresh' template in the workflow library. Not a perfect fit for every jurisdiction, but a good starting point. Lucas: In Marketo, you'd build it from scratch but the logic is straightforward. The important thing is to start. Because every day you don't refresh consent, the clock is ticking on your deliverability and your legal exposure. Luna: And as we saw with Sephora, regulators are watching. It's not just a best practice anymore — it's an expectation. Lucas: Right. And the irony is that automation is the perfect tool to solve a problem that automation itself created. We made it too easy to collect consent once and never think about it again. Now we need to build the second half of that loop. Luna: Seasonal reminder, quarterly check, or annual refresh — whichever you pick, it's better than nothing. That's the takeaway. Lucas: I think that's a good place to leave it. Next episode we'll look at another automation blind spot — how workflows handle customer location changes and the privacy implications there.