Consent for Syndicated Leads: What to Demand From Any Partner

Almost everything written about consent in B2B marketing is written from the buyer's side — what you must do with a lead once you have it. Much less is written from the side that actually collects it, which is where the questions get decided and where a buyer's exposure is created before they ever see the record.

We publish the pages where the opting-in happens, so this is that view. It is not legal advice, and a regime-by-regime compliance programme is a lawyer's job, not a blog post's. What it is: what a buyer should demand from any syndication partner, and what the answers tell you.

The thing most buyers get wrong

Consent to hear from a publisher is not consent to hear from you.

A person subscribing to a newsletter or downloading a report has agreed to something, and what they agreed to is written in the wording they were shown. If that wording named the publisher only, the publisher has permission and you do not automatically inherit it. If it named you, or named a described category of sponsor, that is a materially different record.

This is why "is your data GDPR compliant?" is the wrong question. It invites a yes from everyone. The right question is: was my company named in the wording this person agreed to, and can you show me that wording? It has only one honest answer per record, and it is the single most useful thing a buyer can ask before signing a syndication contract.

What evidence should travel with a lead

Four artefacts, and each one is a fact rather than an assurance.

The property. Which site or newsletter the person opted in on. If a vendor cannot name it, the record has moved through at least one intermediary, and the chain is now something you are trusting rather than something you can inspect.

The timestamp. ISO format, so it is unambiguous across regions and can be compared with your own records. Consent ages differently under different regimes, and a date you cannot parse is not evidence.

The IP address at collection. Corroborates where the person was when they opted in, which matters because it is one input into which regime applies.

The exact wording shown. Not a description of the wording, not a link to a current privacy page that may have been edited since — the text that was on the screen. This is the artefact a data protection officer asks for, and the one most often unavailable.

If a vendor can produce all four per record, the rest of the conversation is straightforward. If they can produce none, no contractual warranty makes up for it, because a warranty transfers liability without producing the evidence anyone will actually ask for.

What differs by regime, in practice

We operate under GDPR and UK GDPR, CASL, CAN-SPAM and CCPA/CPRA. The differences that matter operationally are fewer than the volume of writing on the subject suggests.

GDPR and UK GDPR. Consent is our lawful basis, which means it has to be freely given, specific, informed and unambiguous — and demonstrable, which is the part that turns into an evidence requirement rather than a policy one. "Specific" is where the named-sponsor question lives.

CASL. Express consent, and Canada takes the record-keeping obligation seriously enough that it is worth treating Canadian records as a separate question rather than assuming a GDPR-shaped process covers them.

CCPA and CPRA. A different model — opt-out rather than opt-in, with rights attached to the person. The operational requirement is that an opt-out is honoured across every property, not just the one where it was submitted. Ours are honoured network-wide.

CAN-SPAM. The lightest of the four on collection and the strictest on the mechanics of the send itself — identification, a physical address, and a working unsubscribe.

The practical consequence: a single global programme running on one consent model will be wrong somewhere. Ask how a vendor segments by regime, and be sceptical of an answer that treats the world as one jurisdiction.

Where syndicated leads actually create exposure

Three failure modes, in rough order of how often they cause trouble.

The chain of custody is longer than the invoice suggests. A vendor who sources from partners who source from publishers is selling you a record whose origin they cannot personally attest to. Everyone in the chain has a warranty from the party above them, and nobody has the wording.

The consent is old. A record collected three years ago, under wording since replaced, delivered as a fresh lead. The timestamp exposes this instantly, which is why it should be a required field rather than one supplied on request.

The opt-out did not propagate. Someone unsubscribes on one property and keeps hearing from the same group through another. This is the one that generates complaints from people who did everything right, and it is a systems question rather than a legal one.

What to ask, and what the answers mean

"Show me the opt-in wording for a specific lead." Produced from the record, good. Produced as a template, acceptable. Not available, you have your answer.

"Was my company named in it?" The decisive question. A straight yes or no is a sign of a well-run collection process; a reframing of the question is also informative.

"Who collected this, and were they you?" Establishes the chain of custody in one sentence.

"How does an opt-out propagate across your properties?" Tests whether the network is actually one system or a set of lists with shared branding.

"Which regime did you treat this record under, and why?" If the answer does not vary by geography, the process does not either.

None of these require a legal background to ask or to judge. They are all questions about whether the vendor owns the collection surface — and that single fact determines whether the answers are documents or assurances.