If you don’t know where a list came from, you can’t defend sending to it.
Tag every contact list with its source (lead magnet, checkout, event, partner) and consent basis. Keep that metadata in your ESP so you can separate ‘implied’ relationships from explicit opt‑ins when regulators or platforms ask questions.
The Evidence Question to Ask Yourself: If you can’t say where a list came from and what consent you had, don’t send.
CLIClaw’s Compliance Program Library includes privacy compliance tools you can adapt to your own structure.
