Costs
Part of Email list building, cross-checked against the record, 2027 edition
6 checks a solid email list building checklist should include
Email list building checklist reviews rules, value, accessible forms, source evidence, verification, suppression, measurement, vendors, and change control.
What to take away
- Six checks carry the weightprovable source and consent, honest form and notice, complete records, working suppression, a welcome that delivers first, and named owners with a review date.
- Give every check one of four resultspass, fail, unknown, or not applicable. Unknown blocks sending just as a fail does.
- Record evidence, an owner, a correction, and a review date against each result.
- Match each check to the law of the market: CAN-SPAM for US commercial mail, CASL for Canada, CCPA and CPRA for California residents, GDPR where EU data is in scope.
- Test the full path from collection through confirmation, welcome, preference change, withdrawal, migration, and deletion.
Map the scope and the rules
Write down the scope before anything else: brands, domains, forms, markets, and systems. Then name the laws, contracts, notices, and system behavior that apply.
NIST's Privacy Framework getting-started page frames privacy risk across collection, use, retention, and disposal. That is the same span a list-building audit covers. A runnable version sits in our email list building review, which checks each item against the public record rather than a vendor claim.
Scope and rule map checks
- Sender, audience, markets, relationship, topics, cadence defined
- Dated matrix covers collection, consent, transfers, vendors
- Forms, checkout, accounts, events, partners inventoried
- Official sources versioned, owned, scheduled for review
The six checks
- Source and consent proof. Pull the form, page URL, timestamp, and exact consent wording for a sample of records. Any missing element fails the record, and that record moves to quarantine.
- Form and notice accuracy. Read the live form as a stranger would. It should name the sender, the recurring value, the topics, and the likely frequency, and it should show a way to stop.
- Record completeness. Confirm each record carries source, time, method, form version, wording version, action, market, legal basis, and notice version.
- Suppression propagation. Send one test unsubscribe and one complaint, then verify every system, vendor, brand, and business unit receives it. Our notes on where email list building programs leak signups show how often this breaks at the vendor edge.
- Confirmation and welcome delivery. The promised resource should arrive before any promotion, and the confirmation link should expire under a written rule.
- Ownership and cadence. Name an owner per domainchannel, privacy, legal, security, accessibility, data, deliverability, analytics, and customer service. Set the next review date.
A pass or fail template you can run
| Check | Pass looks like | Evidence to attach on a fail | Owner |
|---|---|---|---|
| Source | Address traces to a form, page, date, and consent wording | Import file with no form version; ticket confirming a purchase | Lifecycle lead |
| Form and notice | Sender, promise, frequency, required fields, and opt-out all visible | Screenshot of a buried data-use clause; pre-ticked box | Web owner |
| Records | Source, basis, notice version, and market stored per record | Sample of 100 records missing the basis field | Data owner |
| Suppression | One unsubscribe test reaches every system within the hour | Vendor feed still active a day later | Deliverability lead |
| Welcome | Promised value arrives before any offer | Welcome email leads with a discount and no resource | Lifecycle lead |
| Governance | Named owner and a future review date on the row | Row reviewed with no name and no date | Program owner |
Example: one gate marked fail
Illustrative case, not a benchmark. A team imports 8,400 addresses collected at a 2022 webinar. A spot check of 100 records finds 14 with no stored form version, so the source gate fails.
Evidence sits with the import file, the vendor contract, and those 14 records. The lifecycle lead owns the fix and the correction: a re-permission email to all 8,400, with confirmation required to stay and suppression for the rest.
The review date is 30 days out. Until the re-permission run closes, the records stay quarantined and no campaign includes them. Do not enable sending while a source, market, promise, action, transfer, or suppression question is open.
Which law sits behind which check
CAN-SPAM sets the US baseline for commercial mail: accurate headers, no deceptive subject lines, identification of the message as an ad, a valid physical postal address, and an opt-out honored within 10 business days.
The FTC compliance guide is the working reference, and our CAN-SPAM subscriber journeys for US marketers trace where each duty lands on a welcome sequence.
Canada's Anti-Spam Legislation requires express or implied consent, clear sender identification, and a working unsubscribe. Its official text governs consent records for Canadian addresses, even from a US sender.
California's CCPA and CPRA give residents rights to know, delete, correct, and opt out of sale or sharing, which reaches suppression lists and third-party feeds. GDPR adds a lawful basis and record-keeping duty when EU subscribers are in scope.
Numbers that make the checks testable
- Spot checksreview 100 to 200 records per source. That is the typical working range for catching a missing consent field.
- Confirmationdouble opt-in completion commonly lands between 40 and 80 percent, and the spread usually tracks the source and the promise. Your own baseline is the comparison that matters.
- Suppressionretest propagation quarterly, and again after any vendor or platform change.
- Cadencerepeat the full checklist twice a year, plus whenever markets, wording, vendors, or official guidance change.
- Bounce hygienemany senders treat a hard-bounce rate above roughly 2 percent as a signal to stop and clean the file.
- Traceabilitya confirmation rate you cannot tie to a source points at the journey rather than the subject line, and the triggers in behavioral trigger email journey ideas only work once consent records are clean.
