Where did this email address come from? Proving consent, one contact at a time

Somebody replies to a campaign asking where you got their address. Not angrily — just asking. And you find you cannot answer, because the contact has been in the list since before anyone was keeping track, and the automation that emailed them simply did what it was told.

This is not primarily a legal problem, though it can become one. It is a record-keeping problem: sending is automated, and consent is the one input to that automation nobody checks.

I am not a lawyer and this is not advice about your obligations, which depend on where you and your recipients are. It is about what your tools record, which turns out to be more than most owners realise.

What a signup actually leaves behind

Mailchimp documents what its consent-collecting forms store, and the list is more useful than "they ticked a box".

When someone signs up through a form with consent fields, the platform keeps a snapshot of the version of the form as it existed at that moment, along with what the person entered, the date, the time and the IP address used to submit it. That sits on the contact's profile and can be exported.

The snapshot is the part worth noticing. It answers not just "did they agree" but "what did they see when they agreed" — which is the question that actually comes up, because forms get edited and the wording somebody consented to two years ago is not the wording on your site today.

Marketing permissions themselves exist as a field — marketing_permissions, with a boolean value, syncable through the API — meaning the answer is data you can query and export, not something you have to reconstruct.

The two timestamps

There is a smaller detail in the same documentation that is disproportionately useful for answering the question in the title.

OPTIN_TIME records when the person submitted your signup form. CONFIRM_TIME records when they clicked the link in the confirmation email. If those two values differ, the contact most likely went through double opt-in.

So for any individual contact you can look at two fields and tell how they joined: form only, or form plus a confirmed click. That is a per-person answer to "where did this address come from", available without asking anybody to remember anything.

Worth checking your own list for a distribution rather than a single case. A block of contacts with neither timestamp is a block that arrived some other way — imported from a spreadsheet, typed in by hand, collected at an event — and those are the ones where your evidence lives outside the platform, if it exists at all.

Single and double, and where it is not optional

Double opt-in adds a step: the person confirms by clicking a link, and only then joins the list.

The trade is familiar. It shrinks your list, because some people never click. It also removes typos and fake addresses, and produces the confirmation timestamp above.

The reason to know about it is not only quality. Mailchimp's documentation notes that some countries — it names Austria, Germany and Norway — require double opt-in for email marketing. Whether that applies to you is a question for your lawyer rather than for me, but if you sell into Europe it is worth asking deliberately rather than discovering later.

The vendor's own recommendation on the same page is worth repeating for a different reason: make the marketing-related field required, or enable double opt-in, so that somebody cannot end up subscribed without having chosen how they want to hear from you. That is a design point as much as a compliance one — a list built by accident performs badly regardless of the law.

What to check in your own list

Sort by how they arrived. Group your contacts by whether they have opt-in data at all. The group without it is your actual exposure, and it is usually older than you expect.

Look at what the form said then. If your platform stores form snapshots, read one from a year ago. If the wording promised something you no longer do — or did not mention the kind of email you now send — that is worth knowing before someone points it out.

Check what happens to a new contact today. Add yourself through your own form. Which fields get set, is there a confirmation step, and what would you be able to show if asked in a year.

Find the side doors. Contacts arriving through an integration, an import, or a workflow that adds people automatically frequently bypass the form entirely, and with it every record described above. Those paths deserve a decision rather than a default.

Make unsubscribing genuinely easy. Most disputes start as irritation at not being able to leave. This is the cheapest thing on the list and the most reliably neglected.

When automation makes this harder

The reason consent drifts is that automated sending scales faster than record-keeping. A workflow that adds every new customer to a newsletter is one decision, made once, that keeps making itself — and the people it adds never saw a form, so none of the evidence above exists for them.

If your automations add people to marketing lists, the question to answer is not whether that is convenient. It is what those contacts would show if you looked them up. A record created by a workflow can carry the source and the timestamp too, if somebody decides it should.

Working out which of your paths create contacts without evidence, and what to attach to them, is one of the things a process audit covers: $299, three business days, and a list of where people enter your systems.

Sources

I read these pages in August 2026. Vendor documentation moves; check the vendor's own page. This is one platform's implementation, and none of it is legal advice.

What a consent form records, including the snapshot, date, time and IP: Mailchimp on collecting consent with GDPR forms.

The two timestamps, what their difference indicates, and the countries named as requiring double opt-in: Mailchimp on signup form options.