# Consent Methods and the List-Quality Spectrum

> The eight ways addresses end up on a mailing list — from confirmed opt-in to harvested — ranked by relationship ownership and complaint risk, with the acquisition rules that keep complaints down.

Source: emailmarketing.net — https://emailmarketing.net/learn/list-management/consent-methods

How an address got onto your mailing list is the best single predictor of whether it will engage, ignore your mail, bounce or complain. The acquisition methods used in the industry, including the ones no legitimate sender should use, can be ranked on one spectrum.

The Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG) formalizes the top three methods as opt-in "levels", with detailed requirements, in its [Sender Best Common Practices](https://emailmarketing.net/learn/industry-best-practices/m3aawg-senders-bcp) (Version 4.0, August 2026). The spectrum below continues past those levels, down through the acquisition methods M3AAWG condemns, so that you can compare the whole range.

## The spectrum: own, borrow, or no relationship

Ordered from best to worst practice:

```
GOOD ◄─────────────────────────────────────────────────────────► BAD
Double    Notified   Single    Opt-out   Affiliate  Rented  Purchased  Harvested
opt-in    opt-in     opt-in
└──── you own the relationship ────┘└─ borrowing someone ─┘└─ no relationship ─┘
                                        else's relationship
└─ the recipient asked you ─┘└────── trickery or no consent at all ──────┘
   to contact them
```

Two questions place any method on the spectrum:

1. **Whose relationship is it?** With the opt-in methods, the recipient's relationship is with you. With affiliate, rented or purchased lists, you are borrowing or buying someone else's relationship. With harvested lists there is no relationship at all. **Consent is not transferable.** A subscriber's permission for Company A never extends to Company B.
2. **Did the recipient ask to be contacted?** Only the opt-in methods can answer yes. Every method from opt-out onward relies on inertia, on trickery, or on nothing.

Complaint rates rise at every step along the spectrum, and complaints are among the strongest negative reputation signals that mailbox providers use (see [Metrics and Benchmarks](https://emailmarketing.net/learn/operations/metrics-and-benchmarks) for thresholds).

## The eight methods

| Method | Mechanics | Complaint and risk profile |
|---|---|---|
| **Confirmed ("closed-loop") or double opt-in** | Signup triggers a confirmation email. The address is not mailed until the recipient clicks a link or replies. | The lowest complaint rate. It blocks typos, forged signups and [spam traps](https://emailmarketing.net/learn/reference/spam-traps), because a trap address can never complete confirmation. M3AAWG Level 3 ("best"). M3AAWG also says that when a subscriber changes their address, the new one should go through the same confirmation. |
| **Notified opt-in** | Signup triggers a welcome email, but the address joins the list without confirmation. | Popular. It produces more complaints than double opt-in, because typos and maliciously submitted addresses enter the list. M3AAWG Level 2. If the welcome email bounces, M3AAWG says to process it as a bounce and take the address off the list. |
| **Single opt-in** | The recipient knowingly checks an empty "sign me up" box on a form (at checkout or registration). No confirmation or welcome message follows. | Open to abuse and to pollution by typos. Complaint and bounce rates are higher, and they can escalate into delivery problems. M3AAWG Level 1: "use with extreme caution." |
| **Opt-out (pre-checked or automatic)** | The address is added automatically, through a pre-checked box or on purchase, and the recipient must unsubscribe or uncheck the box to avoid mail. | Recipients feel tricked, and complaint volumes are large. M3AAWG treats the two mechanisms differently. Adding someone who gave an address at checkout, with no notice that marketing would follow, is what it calls implied consent: not a best practice, and to be avoided where possible. A pre-checked box fares worse: an extra purpose "must not be opt-in by default", and the consent box M3AAWG recommends is a distinct, unchecked one. Under [CASL](https://emailmarketing.net/learn/compliance/casl), implied consent is legal only in narrow, time-limited circumstances. If you use either at checkout, switch to an unchecked box or to confirmation. |
| **Affiliate lists** | Company A shares addresses with "partners", often through signup language such as "…and relevant partners". | Recipients who signed up with Company A do not recognize Company B, and they complain. The complaint rate is high, and delivery problems tend to persist. |
| **Rented lists** | The sender pays a list owner to send the sender's content to the owner's list, usually once. The sender never sees the addresses. | No relationship with recipients, and high bounce and complaint rates. The list owner **and** the sender share the reputation damage. Under CAN-SPAM, "even if you hire another company to handle your email marketing, you can't contract away your legal responsibility to comply with the law" (FTC; see [CAN-SPAM](https://emailmarketing.net/learn/compliance/can-spam)). |
| **Purchased lists** | Addresses bought outright. | Recipients never opted in to hear from the buyer. Expect spam flags, damaged relationships with the brand, invalid addresses and pristine spam traps. Buying a list also lowers delivery to the sender's existing opted-in audience, because it drags down the shared reputation. Most reputable email service providers (ESPs) refuse this business outright. |
| **Harvested ("scraped") lists** | Addresses collected by crawling the web for anything shaped like `something@domain.com`, or by dictionary and directory harvest attacks that guess patterned corporate addresses (`jdoe@`, `john.doe@`). | A spammer technique. There is no consent and no relationship, complaints, bounces and pristine trap hits are at their highest, and collecting addresses this way is illegal in several jurisdictions. |

The anti-spam policy of practically every ESP prohibits harvested, purchased, rented and affiliate lists. Using them is grounds for terminating the account, on top of the reputation damage.

### The existing-business-relationship trap

**An existing business relationship with someone does not make it okay to add them to a mailing list.** Customers who are added automatically, or through an unclear signup, mark mail as spam simply because they do not recognize the sender or never wanted the mail. At the point of purchase, offer the option to subscribe instead of subscribing people automatically.

The law is more permissive than good practice here. CAN-SPAM permits mailing without prior consent, and the implied consent CASL grants for an "existing business relationship" is time-limited (see the [compliance overview](https://emailmarketing.net/learn/compliance)). But what is legal is not what keeps complaint rates survivable. M3AAWG's principle is that recipient expectations outrank what a privacy policy technically allows.

## Acquisition rules that keep complaints down

Complaints are one of the largest single influences on sender reputation, so design your acquisition practice to prevent them:

- Never use a purchased, harvested or scraped list of any kind
- Have a direct relationship with every address on the list
- Confirm new signups (double opt-in)
- Ask people whether they want to subscribe, and never sign them up automatically
- Make the signup process explicit: what people are signing up for, when mail starts, and how often it will arrive
- Use a consistent From name and address
- Use subject lines that truthfully describe the content
- Honor opt-outs promptly (see [List-Unsubscribe](https://emailmarketing.net/learn/list-management/list-unsubscribe); Gmail and Yahoo now require one-click unsubscribe from bulk senders)
- Comply with the anti-spam law of every region you send to ([CAN-SPAM](https://emailmarketing.net/learn/compliance/can-spam), [CASL](https://emailmarketing.net/learn/compliance/casl), [PECR](https://emailmarketing.net/learn/compliance/uk-pecr-email-marketing) and GDPR, among others). A single address in a jurisdiction is enough to bring its law into play, so follow the strictest rules that apply
- Keep the list current, and **never reactivate old or previously invalid addresses**. A hard-bounced address may since have been turned into a recycled [spam trap](https://emailmarketing.net/learn/reference/spam-traps), and mailing an unsubscribed address is illegal in most jurisdictions. This matters especially when you migrate to a new ESP: never carry hard bounces or unsubscribes into the new platform as active contacts
- Send on a regular schedule, so the list never goes stale

The consent method sets list quality at the point of entry. [List Hygiene and Sunset Policies](https://emailmarketing.net/learn/operations/list-hygiene-and-sunset-policies) covers keeping that quality over time, and adds validation at signup (syntax and MX checks, CAPTCHA, typo detection) on top of the consent method.

## Related articles

- [M3AAWG Senders BCP](https://emailmarketing.net/learn/industry-best-practices/m3aawg-senders-bcp), including the formal opt-in levels 1–3
- [List Hygiene and Sunset Policies](https://emailmarketing.net/learn/operations/list-hygiene-and-sunset-policies)
- [Spam Traps](https://emailmarketing.net/learn/reference/spam-traps)
- [Complaint Feedback Loops](https://emailmarketing.net/learn/list-management/complaint-feedback-loops)
- [Seven-Step Delivery Model](https://emailmarketing.net/learn/foundations/seven-step-delivery-model)
- [Compliance overview](https://emailmarketing.net/learn/compliance)