The policy requires senders to hold documented proof of permission for every subscriber, either through direct opt-in or through a purchase made within the preceding 12 months where email consent was obtained at the point of sale.
This analysis describes what ConvertKit's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision establishes a platform-level permission standard that requires documented proof of consent for each subscriber, and limits purchase-based consent to a 12-month window, creating an ongoing compliance obligation for list hygiene and consent record-keeping.
Interpretive note: The adequacy of the 12-month purchase-based consent window under GDPR and UK GDPR consent standards depends on jurisdiction and the specific manner in which consent was obtained at the point of purchase.
Under this clause, account holders are required to maintain verifiable records of subscriber consent for the entirety of their subscriber lists; subscribers added through purchase without documented consent at the time of purchase, or purchase-based consent older than 12 months, do not satisfy the policy's permission standard.
Cross-platform context
See how other platforms handle Subscriber Permission Requirement and similar clauses.
Compare across platforms →"Kit is a permission-based email marketing platform. We require that all Subscribers have given direct permission to receive marketing emails from the sender, or have purchased an item from the sender within the past 12 months and consented to receive emails at the time of purchase. Customers are required to have proof of permission for each Subscriber on their list.Excerpt from ConvertKit's Acceptable Use Policy
(1) REGULATORY LANDSCAPE: The permission standard stated in this provision engages the CAN-SPAM Act (explicitly referenced elsewhere in the policy), which governs commercial email practices in the United States.
Enforcement risk, jurisdiction flags, contract triggers, and due diligence action items.
Get the research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean.
This provision establishes a platform-level permission standard that requires documented proof of consent for each subscriber, and limits purchase-based consent to a 12-month window, creating an ongoing compliance obligation for list hygiene and consent record-keeping.
Under this clause, account holders are required to maintain verifiable records of subscriber consent for the entirety of their subscriber lists; subscribers added through purchase without documented consent at the time of purchase, or purchase-based consent older than 12 months, do not satisfy the policy's permission standard.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by ConvertKit.