Consent Methods and the List-Quality Spectrum

Every address on a mailing list got there somehow, and how is the single best predictor of whether that address will engage, ignore, bounce, or complain. This article catalogs the acquisition methods used in the industry — including the ones no legitimate sender should use — and ranks them on a single spectrum. The M3AAWG Senders BCP formalizes the top three methods as opt-in "levels" with detailed requirements; this article extends the taxonomy downward through the acquisition methods M3AAWG condemns, so the whole range can be compared.

The spectrum: own, borrow, or no relationship

Ordered from best to worst practice:

GOOD ◄─────────────────────────────────────────────────────────► BAD
Double    Notified   Single    Opt-out   Affiliate  Rented  Purchased  Harvested
opt-in    opt-in     opt-in
└──── you own the relationship ────┘└─ borrowing someone ─┘└─ no relationship ─┘
                                        else's relationship
└─ the recipient asked you ─┘└────── trickery or no consent at all ──────┘
   to contact them

Two framing questions position any method on the spectrum:

1. Whose relationship is it? With the opt-in methods, the recipient's relationship is with you; with affiliate/rented/purchased lists you are borrowing (or buying) someone else's relationship; with harvested lists there is no relationship at all. Consent is not transferable — a subscriber's permission for Company A never extends to Company B.
2. Did the recipient ask to be contacted? Only the opt-in methods can answer yes. Everything from opt-out rightward relies on inertia, trickery, or nothing.

Complaint rates rise monotonically along the spectrum, and complaints are among the strongest negative reputation signals mailbox providers use (see Metrics and Benchmarks for thresholds).

The eight methods

Method	Mechanics	Complaint/risk profile
Confirmed ("closed-loop") / double opt-in	Signup triggers a confirmation email; the address is not mailed until the recipient clicks/replies.	Lowest complaint rate; blocks typos, forged signups, and spam traps — a trap address can never complete confirmation. M3AAWG Level 3 ("best").
Notified opt-in	Signup triggers a welcome email, but no confirmation is required before list addition.	Popular; more complaints than double opt-in because typos and maliciously submitted addresses enter the list. M3AAWG Level 2.
Single opt-in	Recipient knowingly checks an empty "sign me up" box on a form (checkout, registration); no confirmation or welcome message.	Open to abuse and typo pollution; higher complaint and bounce rates that can escalate to delivery problems. M3AAWG Level 1 — "use with extreme caution."
Opt-out (implied consent)	Address added automatically — pre-checked box, or added on purchase — and the recipient must unsubscribe or un-check to avoid mail.	Recipients feel tricked; generates large complaint volumes. Not a best practice per M3AAWG; under CASL implied consent is legal only in narrow, time-limited circumstances. If you use it at checkout, switch to an unchecked box or confirmation.
Affiliate lists	Company A shares addresses with "partners" — often via "…and relevant partners" signup language.	Recipients who signed up with Company A don't recognize Company B and complain. High complaint rate, prone to ongoing delivery problems.
Rented lists	Sender pays a list owner to mail the sender's content to the owner's list, usually one-time; the sender never sees the addresses.	No relationship with recipients; high bounce and complaint rates. The reputation damage is shared between list owner and sender — and under CAN-SPAM, "even if you hire another company to handle your email marketing, you can't contract away your legal responsibility to comply with the law" (FTC; see CAN-SPAM).
Purchased lists	Addresses bought outright.	Recipients never opted in to hear from the buyer; expect spam-flagging, damaged brand relationships, invalid addresses, and pristine spam traps. Buying a list also degrades delivery for the sender's existing opted-in audience by dragging down shared reputation. Most reputable ESPs refuse this business outright.
Harvested ("scraped") lists	Addresses collected by crawling the web for anything shaped like something@domain.com, or by dictionary/directory harvest attacks guessing patterned corporate addresses (jdoe@, john.doe@).	A spammer technique. No consent, no relationship; maximal complaints, bounces, and pristine-trap hits; illegal address collection in several jurisdictions.

Practically every ESP's anti-spam policy prohibits harvested, purchased, rented, and affiliate lists; using them is grounds for account termination in addition to the reputation damage.

The existing-business-relationship trap

Having an existing business relationship with someone does not make it okay to add them to a mailing list. Customers added automatically — or through an unclear signup — flag mail as spam simply because they don't recognize the sender or never wanted the mail. Offer the option to subscribe at the point of purchase instead of subscribing automatically. (Legal nuance: CAN-SPAM permits mailing without prior consent, and CASL's "existing business relationship" implied consent is time-limited — see the compliance articles — but what is legal is not what keeps complaint rates survivable. M3AAWG's principle: recipient expectations outrank what a privacy policy technically allows.)

Acquisition rules that keep complaints down

Complaints are one of the largest single influences on sender reputation, so acquisition practice should be optimized to prevent them:

• Never use a purchased, harvested, or scraped list of any kind
• Have a direct relationship with every address on the list
• Confirm new signups (double opt-in)
• Ask people whether they want to subscribe — never sign them up automatically
• Make the signup process explicit: what they're signing up for, when mail starts, and how often it will arrive
• Use a consistent From name and address
• Use subject lines that truthfully describe the content
• Honor opt-outs promptly (see List-Unsubscribe — Gmail and Yahoo now mandate one-click unsubscribe for bulk senders)
• Comply with the anti-spam law of every region you mail to (CAN-SPAM, CASL, PECR/GDPR, …) — one address in a jurisdiction is enough to trigger its law, so adhere to the strictest applicable rules
• Keep the list current; never reactivate old or previously-invalid addresses — a hard-bounced address may since have been converted into a recycled spam trap, and mailing an unsubscribed address is illegal in most jurisdictions (this matters especially when migrating ESPs: never carry hard bounces or unsubscribes into the new platform as active contacts)
• Send on a regular basis so the list never goes stale

Consent method determines list quality at the entry point; keeping quality over time is covered in List Hygiene and Sunset Policies, which adds signup-time validation (syntax/MX checks, CAPTCHA, typo detection) on top of the consent method.

Related

• M3AAWG Senders BCP — the formal opt-in levels 1–3, proof-of-consent record keeping, email-append prohibition
• List Hygiene and Sunset Policies — validation at signup and the address lifecycle after acquisition
• Spam Traps — why purchased/harvested lists contain pristine traps and stale lists contain recycled ones
• Complaint Feedback Loops — how complaints reach the sender
• Seven-Step Delivery Model — where list assembly sits in the campaign lifecycle
• Compliance overview