Email Marketing
LawMarketing emails need their own specific consent, separate from any transactional communication (an order confirmation, a password reset) the recipient also receives. Bundling "create an account" with "receive our newsletter" into a single consent is a recurring violation of the "specific" requirement covered in Chapter 04.
SMS Marketing
The same purpose-specificity applies across channels — consent to receive marketing emails doesn't automatically extend to SMS or WhatsApp marketing on the same contact details. Each channel a Data Principal might be contacted through for marketing purposes is worth its own explicit, itemised consent, or at minimum a clearly disclosed and separately toggleable preference.
WhatsApp Communication
PracticeWhatsApp Business messaging for marketing purposes carries the same DPDP consent requirements as any other channel, on top of WhatsApp's own business messaging policies. A phone number collected for order updates (a transactional purpose, often covered by a legitimate use rather than consent) shouldn't be silently repurposed for promotional WhatsApp broadcasts without its own separate consent.
Lead Generation
Lead-gen forms — gated ebooks, webinar signups, demo requests — are covered by the same collection standard as any other form (Chapter 15), with the added wrinkle that lead data is often immediately synced into a CRM and marketing automation tool, meaning the consent captured needs to travel with the record into every system that will act on it, not stay behind in the form tool alone.
Retargeting and Advertising Pixels
LawAd pixels (Meta Pixel, LinkedIn Insight Tag, and similar) collect browsing behaviour and device identifiers to build retargeting audiences — this is personal data processing requiring its own marketing/advertising-purpose consent, gated the same way analytics tracking is covered in Chapter 15, and blocked from firing until that consent is given.
A visitor browses a product page without logging in or submitting any form, but a retargeting pixel fires anyway and later serves them an ad for that exact product on a different site. If that pixel fired before any consent was captured, the underlying tracking never had a lawful basis — regardless of how standard this pattern is across the ad-tech industry.
Analytics and Audience Data
Audience segments built from analytics and CRM data for targeted marketing carry the same underlying consent requirements as the data they're built from — a segment built partly from consented data and partly from data collected without a valid basis doesn't become lawful simply because it's aggregated into a segment.
CRM and Marketing Automation
PracticeThis is where consent withdrawal (Chapter 04.2) most commonly breaks down in practice — a CRM often holds the "source of truth" consent flag, while a separate marketing automation tool, ad platform audience list, and analytics tool each maintain their own copy. A single unsubscribe action needs to reach all of them, or the recipient keeps receiving marketing through a channel the withdrawal didn't actually touch.
Treating an email-platform "unsubscribe" as equivalent to full marketing consent withdrawal. If the same contact's identifier is still active in a retargeting audience or a separate SMS tool, they'll keep being marketed to through those channels even though they correctly unsubscribed from email — the withdrawal needs to propagate everywhere the original consent was relied on.
Third-Party Marketing Platforms
Any marketing platform you share customer or lead data with (an ad network, an influencer platform, a co-marketing partner) is a third-party data recipient under Chapter 06's sharing rules — that sharing needs its own basis, and the platform itself should be tracked as a vendor under Chapter 12.