Latest / Marketing Automation with Fexingo: HubSpot, Marketo, and Automated Customer Journeys / How Marketing Automation Workflows Miss Customer Privacy Preferences
Transcript
- Lucas: So Luna, when was the last time you changed a privacy setting on an app or website you use regularly? Luna: Honestly, probably last week. I toggled off some data-sharing permissions in a ride-sharing app. Why do you ask? Lucas: Because most marketing automation platforms don't catch that kind of change. You update your privacy preferences, but the system that decides whether you get an email or a push notification is still operating off the old setting. Luna: Wait, so if I tell a company I don't want to be tracked, their automated workflows might still treat me as if I opted in? Lucas: Exactly. And it's a bigger problem than most marketers realise. A 2025 consumer survey by the International Association of Privacy Professionals found that 43 percent of respondents had changed at least one privacy setting in the past twelve months. That's not a niche behaviour — it's nearly half of all consumers. Luna: That's a huge number. So what happens inside a typical marketing automation platform when someone updates their consent? Lucas: In theory, the preference centre should update a field in the CRM — something like a 'consent status' field. But the workflows that trigger emails, SMS, or ad retargeting often check that field only once when the lead is created. If the status changes later, the workflow doesn't re-evaluate. Luna: So the automation is effectively blind to updates. That feels like a basic design flaw. Lucas: It is, and it's surprisingly common. I spoke with a marketing ops manager at a mid-sized hospitality chain last month. They had a guest who had stayed with them three times, opted into promotional emails, and then later revoked consent via a preference centre link. But their welcome-back workflow — the one that fires after a guest hasn't booked in ninety days — still sent her a 'We miss you' email with a discount code. Luna: Ouch. Did she complain? Lucas: She didn't just complain. She filed a complaint with Ireland's Data Protection Commission under GDPR. The company ended up with a fine and a mandatory audit of their consent management processes. All because a workflow didn't check the current privacy status before sending. Luna: So what's the fix? Is it a platform limitation, or is it something teams can solve with better configuration? Lucas: It's both. Some platforms like Marketo and HubSpot do offer 're-evaluation triggers' — you can set a workflow to check consent status every time a field changes. But that's not the default, and many teams don't know it exists. The better approach is to use a real-time consent API that sits between your CRM and your marketing automation platform. Luna: How does that work in practice? Lucas: When a customer updates their preferences in your preference centre — or even through a mobile app setting — the API broadcasts that change to every downstream system immediately. So before any email is sent, the system can query the API to check: 'Is this person still consented?' If not, the send is blocked in real time. Luna: That sounds like a lot of engineering. Is there a simpler interim step? Lucas: There is. A simpler step is to build a 'consent re-confirmation' campaign that runs every quarter. You send a message asking customers to confirm their preferences. But that only works if the people who opt out are removed from the main workflows immediately. The real issue is that most automation platforms treat consent as a static attribute rather than a dynamic state. Luna: Right, and that mindset is probably rooted in how CRM databases were built decades ago. Fields were meant to be filled once and rarely changed. Lucas: Exactly. And the legal landscape has shifted dramatically. Under GDPR, consent must be as easy to withdraw as it was to give. Under the California Consumer Privacy Act, consumers have the right to opt out of the sale of their data at any time. If your automation doesn't respect that in real time, you're not just annoying people — you're breaking the law. Luna: I think a lot of marketers don't realise how expensive that can be in terms of trust, too. If a customer feels ignored when they try to pull back, they're probably gone for good. Lucas: Completely. And there's data on that. A 2024 Edelman Trust Barometer study found that 68 percent of consumers say they've stopped buying from a brand because of how their data was handled. Privacy isn't just a compliance box — it's a core part of customer experience. Luna: So for a marketing ops person listening to this, what's the first thing they should check tomorrow morning? Lucas: Check your most-used workflows — especially the ones that send triggered emails based on behaviour or time delays. Pull up the list of recipients from last month and cross-reference it with your current consent status field. If you find even one person who has opted out but still received a message, you have a gap. Luna: And then fix that workflow to check consent at the moment of send, not just at the moment of entry. Lucas: Exactly. And if your platform doesn't support that, it might be time to look at a consent management platform that integrates via API. The upfront engineering effort is real, but the cost of ignoring it is higher. Luna: You know, this is the kind of practical insight that I find really valuable on this show. And it's exactly why I appreciate that we don't clutter these episodes with ads. Lucas: Yeah, we've always felt that if we're going to talk about marketing, we should model respect for the audience's attention. No ads, no sponsorships, no tracking pixels in the show notes. Luna: If these conversations have helped you think differently about your own automation, and you want to support that choice, there's a link: buy me a coffee dot com slash fexingo. No pressure, just a way to keep it ad-free. Lucas: Appreciate that. Alright, back to the nuts and bolts — let's talk about how to audit your consent infrastructure step by step. Luna: Good. So what are the specific fields and data points we should be looking at? Lucas: Start with the consent source. Did the customer opt in via a checkbox on a web form, or via a preference centre after they already had an account? The source matters because different platforms handle updates differently. Luna: Right, and the timestamp of the last consent change is critical too. If it's older than six months, many privacy regulations require you to re-confirm. Lucas: Exactly. Under GDPR's 'right to erasure' you can't just leave inactive consent hanging. Some companies now run a monthly job that flags records where consent is older than a year and sends a re-confirmation request. If no response, they set consent to 'not provided' and suppress those contacts. Luna: That's a solid operational practice. Do you see any common pitfalls in how teams implement those re-confirmation flows? Lucas: The biggest one is sending the re-confirmation email to people who have already opted out. That happens when the workflow doesn't check the current consent status before sending the re-confirmation. It's a recursive loop of frustration. Luna: So the rule is: always check consent at the moment of send, not just at workflow entry. Lucas: Always. And if you're using a platform like Marketo, you can use 'smart lists' that dynamically update based on consent field changes. In HubSpot, you can set up 'goal-based workflows' that re-evaluate enrolment criteria at each step. Luna: What about platforms that don't have those features? Are there workarounds? Lucas: You can build a custom integration using webhooks. When a consent change happens in your preference centre, fire a webhook that removes the contact from all active workflows in the marketing automation platform. It's a bit more manual but it works. Luna: And it's probably cheaper than a fine. Lucas: Much cheaper. The average GDPR fine for email-related violations in 2025 was around 750,000 euros. That buys a lot of engineering hours.