Waking a dormant list: consent rules in five jurisdictions

"They bought from us, so we can email them." Somebody in marketing says it about the customer table of an invented furniture retailer: 14,000 rows, exported in September, the last purchase on most of them in 2021. Somebody else asks why a customer complained to the regulator last time.

Both are partly right. The customers are real, but the paperwork that would let you write to them often is not, and the rules change with where the person lives and which channel you use.

This post is a map, not a verdict. It follows what regulators publish for the US, the UK, the EU, the UAE, and India. Where we could not confirm a point against a primary page, we say check with counsel instead of guessing. Nothing here is legal advice. It is general information, last verified on October 2, 2026, and the law moves.

Start with the channel, not the country

Most mistakes come from treating "marketing" as one thing. Email, texts, and calls are three, and the rules differ. In the US, for example, the CAN-SPAM guide asks for no prior consent to email while the FCC restricts robocalls and robotexts without consent,^[1][2] and the UAE telecoms regulator has a policy written specifically for texts.^[3] A list that is fine to email can be a liability to text. So ask which channel you plan to use, and where you hold evidence of permission for that channel specifically.

What consent has to look like

The UK regulator says valid consent needs a "clear affirmative act", and that silence, pre-ticked boxes, and inactivity do not count.^[4] For a dormant list, three questions matter more than any others:

1. Did they agree to this kind of message? Consent to receive order updates is not consent to receive a win-back campaign.
2. Do you have a record? Date, time, the words they saw, and how they agreed. For marketing texts, the UAE telecoms regulator says the record should include the date, time, and the words or content by which the customer consented.^[3]
3. Is it still fresh? The ICO says to keep consents under review and refresh them if your purposes change.^[4]

If you cannot answer the first two from your own records, you do not have consent. You have a hope.

United States

Email. The FTC's guide to the CAN-SPAM Act reads differently from European rules. Its requirements are about what an email must contain and about honoring opt-outs, not about getting consent first; it does say, of subscription members, that you don't need their consent to send marketing emails. Read the guide for the full list.^[1] The guide also says the law makes no exception for business-to-business email.^[1]

The opt-out must be honored within 10 business days, and whatever opt-out mechanism you offer must keep working for at least 30 days after you send.^[1] The guide also states a per-email penalty, which was up to $53,088 in the edition we read. It is adjusted over time, so check the current figure.^[1]

State rules sit on top of this. We did not confirm them against primary sources: check with counsel.

Texts and calls. This is where US lists get expensive. The FCC's February 2024 order on revoking consent says people can revoke consent in any reasonable way. Replying with words such as "stop", "quit", "end", "revoke", "opt out", "cancel", or "unsubscribe" counts, and requests must be honored within a reasonable time, no more than 10 business days after receipt.^[2] One confirmation text is allowed, and it must carry no marketing.^[2] The order sets later effective dates for some of its provisions than for the rest, and we did not confirm which are in force today. Check with counsel before relying on the timing.^[2]

What counts as valid prior consent for automated marketing texts is a moving area, and we could not confirm the current written-consent wording against a primary page. For texting a dormant list in the US: check with counsel before the first message.

United Kingdom

The UK is easy to get wrong because of a feature called the soft opt-in.

Under the UK's electronic-marketing rules (PECR), you can market to an existing customer by electronic mail without fresh consent only if all of these hold. The ICO's page lists them: the person bought, or negotiated to buy, a similar product or service from you in the past; you gave them a simple way to opt out when you first collected their details; and you give them one in every message.^[5] The ICO's plain-English gloss on the idea speaks of someone who bought "recently", though its formal statement says "in the past". For a 2021 list, that gap is a question for counsel.^[5]

Read that as a narrow door, not a loophole:

• It does not cover people who never bought. The ICO says it does not apply to prospective customers or new contacts, for example from bought-in lists.^[5]
• It does not cover unrelated products. "Similar" does real work. Where the line sits between a sofa and a financing product is a judgment call: check with counsel.
• It does not fix a missing opt-out at the start. If nobody offered an opt-out when the details were collected, the condition fails, and fine print in your next email cannot repair it.^[5]

For businesses the ICO's page is more relaxed: you can email or text a corporate body (a company, Scottish partnership, limited liability partnership, or government body), though it recommends keeping a do-not-contact list. Sole traders and some partnerships are treated as individuals, so the rules above apply to them.^[5] The UK GDPR separately requires a lawful basis for holding the data at all, and the ICO says its consent guidance is under review after the Data (Use and Access) Act, so read the current text.^[4]

European Union

The EU sits on two layers. The GDPR sets the standard for what valid consent is, and the ePrivacy rules (implemented by each member state) decide when you need consent for electronic marketing. The European Data Protection Board publishes its guidelines on consent as the reference for the first layer.^[6]

We could not retrieve the primary legal text of either layer to check line by line, and member states differ on existing customers and business contacts, so we will not summarize EU rules as uniform. A safe working assumption is the strict one: opt-in evidence for the channel and purpose, a clear way out in every message, and no UK-style soft opt-in until a lawyer in the specific country confirms it. Check with counsel for the country your contacts live in.

United Arab Emirates

Two separate things apply here.

Data protection. The government portal describes the federal personal data protection law (Federal Decree-Law 45 of 2021) as prohibiting the processing of personal data without the owner's consent, except in some cases, such as protecting a public interest. It came into force on January 2, 2022, and the UAE Data Office was to issue guidelines for implementing it.^[7] DIFC has its own separate law.^[7] We could not retrieve the full text or confirm the state of the executive regulations. Check with counsel on which regime applies to your contacts.

Marketing text messages. The telecoms regulator, TDRA, publishes a policy on unsolicited electronic communications, version 1.1 of June 2022, that applies to text messages with a UAE link. It is addressed to licensed operators, and it is specific: marketing texts need the customer's consent, evidence of that consent must be kept, every marketing text must offer a way to opt out, subscribing and unsubscribing must be free, and marketing texts may not be sent between 9 p.m. and 7 a.m.^[3] For an operator's own marketing, two unanswered consent requests a month apart count as a decline.^[3] For businesses that send through an operator, the policy's model contract terms say the business must not start a consent request by text message or voice call itself, so you cannot text a dormant list to ask for permission.^[3] You will meet this policy through your operator or messaging provider. Check with counsel on what it means for you directly, and on newer UAE telemarketing rules, which we did not read.

India

India is changing. Parliament enacted the Digital Personal Data Protection Act on August 11, 2023, and the government notified the DPDP Rules on November 14, 2025, with an 18-month period for phased compliance.^[8] The government's explainer says each data fiduciary must issue a separate consent notice that explains the specific purpose for which data is collected and used, and that people can withdraw consent at any time.^[8] It also states penalties of up to ₹50 crore for violations not otherwise listed.^[8]

Which parts apply to you on which date inside that 18-month window is not something we confirmed, and old data collected before the Act is a question the explainer does not settle. Check with counsel.

India also has a telecom layer for commercial messages. TRAI tells senders to register as a principal entity, use registered headers and registered content templates, and acquire customer consent through a registered consent template before sending commercial communication.^[9] That is not a list-upload-and-send process.

Why a purchased list rarely carries consent

The UK regulator is direct about this. The ICO says you can use a bought-in list for email, text, or recorded calls only if everyone on it specifically consented to receive that type of message from you, and that generic consent covering any third party is not enough.^[10] It also says you must check that the list is accurate, that details were collected fairly, and that consent is specific and recent enough to cover your marketing.^[10] And on its email page it says the soft opt-in does not apply to new contacts from bought-in lists.^[5]

The same logic should hold elsewhere, since consent is a relationship between a person and a named organization, but we confirmed the wording only for the UK; check with counsel for the rest. If a seller cannot show you, person by person, a record naming your company, the channel, and the date, treat the list as a list of strangers.

What to do with a very old list

No single number of years makes a list expire. The ICO's wording is that consent must be "specific and recent enough" for your marketing.^[10] How recent is recent enough is a judgment, and in most jurisdictions above it is a question for counsel.

What a careful operator does in practice:

1. Split by evidence, not by age. Group contacts into: has a recorded opt-in for this channel; is an existing customer with a clear opt-out offered at collection; or neither. Only the first two groups are candidates.
2. Suppress first. Before anything else, match the list against your own unsubscribe, bounce, and "stop" records. Opt-outs outlive campaigns.
3. Start with the freshest contacts and the lowest-risk channel. Last year's buyers are a different group from a 2019 spreadsheet.
4. Send a small, honest first message. Say who you are, why you are writing, and how to stop.
5. Cap the volume. A daily ceiling gives you time to read replies and complaints before a mistake reaches the whole list.
6. Honor every opt-out at once, on every channel. The FTC allows 10 business days and the FCC the same ceiling,^[1][2] but nothing is gained by waiting. Keep a log of who got what.
7. Let the rest go. Contacts with no evidence of permission and no recent purchase are not an asset you are failing to use. They are a risk you are carrying.

What a dormant-list system can and cannot do

Gonzo Digital builds the Dormant List Revival system. It segments an existing customer list by recency and value, runs a written win-back sequence in stages rather than all at once, sends at a daily cap that a person sets, and honors opt-outs. Nothing has run live yet. It cannot create consent your records do not hold, and it does not replace a lawyer in the countries you send to.

If you are not sure what is safe to do with your list, tell us what is in it and which channels you hold evidence for. Sometimes our answer will be "do not send this", which is a perfectly good outcome. You can talk to us first.