What it is
Subscription provenance is the audit trail behind permission: source, timestamp, notice shown, purpose, confirmation, and later changes.
Why it matters
An address in a database is not evidence that its owner asked for every kind of mail. Expectations determine complaints and legal risk.
How to implement
Store the acquisition source and policy version, separate purposes, make refusal as easy as acceptance, and propagate withdrawal to every sender.
Common mistakes
- Treating account creation as marketing consent.
- Importing a list without its provenance.
- Recording only a mutable boolean.
Verification
Pick sample recipients and reconstruct the complete permission history. Confirm a withdrawn purpose cannot be restored by a stale integration.
Sources
- GDPR Article 7 — Conditions for consent — European Union