Can opt-out, do-not-contact or unsubscribe flag from a CRM be fed to an AI tool?

Yes, under the existing purpose and with the model provider under a processor agreement.

Every field · Consent, preferences and rights

Opt-out, do-not-contact or unsubscribe flag

Q: Is opt-out, do-not-contact or unsubscribe flag personal data?

Personal data. An opt-out is a right being exercised (Art. 21, CPRA 1798.120). It must be honoured across every channel and never lost in a deletion.

An opt-out is a right being exercised (Art. 21, CPRA 1798.120). It must be honoured across every channel and never lost in a deletion.

personal data

personal data?

standard

sensitivity

usable

AI use

legal obligation (honouring objections)

lawful basis usually relied on

Keep it how long

Keep indefinitely as a suppression record; never delete an opt-out.

The gap we see most

Opt-outs deleted with the contact, so the person is re-imported and re-emailed from another list.

What holding it is evidence for

Requirement text and artefacts stated in our own words from the published standards.

Opt-out and objection flags GDPR Art.21 · CCPA/CPRA §1798.120 · CCPA/CPRA CCR 7026 · CCPA/CPRA CCR 7025 · ISO/IEC 27701:2019 7.3.5

GDPR Art.21 Right to object

Where processing is based on the performance of a public interest task, official authority or legitimate interests, including profiling on those bases, the data subject may object at any time on grounds relating to their particular situation, and processing must stop unless the controller demonstrat...

Evidence an auditor accepts: Objection records that distinguish direct marketing objections, which are absolute, from Article 21(1) objections, which are balanced; The compelling legitimate grounds analysis for every Article 21(1) objection that was refused; Evidence the right to object was presented clearly and separately at first communication, such as the template or screen as sent

CCPA/CPRA §1798.120 Honour the right to opt out of sale or sharing

Consumers may at any time direct a business selling or sharing their data to stop. The business must give notice that it may sell or share data and that this right exists, and after receiving the direction must not sell or share that consumer's data unless the consumer later consents. A business tha...

Evidence an auditor accepts: Opt-out preference store and the integrations that read it before any sale or sharing; Inventory of data flows that count as selling or sharing, including advertising pixels and SDKs; Due diligence checklist for acquired data sets carrying over opt-out status

CCPA/CPRA CCR 7026 Handle requests to opt out of sale or sharing

The business must offer two or more easy methods to opt out, at least one matching its main channel; an online business must accept opt-out preference signals plus a form, link or policy route, and a cookie banner alone does not count. No verification or account may be required, and only suspected f...

Evidence an auditor accepts: Opt-out request log with receipt and effective dates; Evidence that sale and sharing stopped within 15 business days, or immediately where real-time bidding allows; Notifications sent to third parties that received data between request and implementation, with onward-forwarding instructions

CCPA/CPRA CCR 7025 Process opt-out preference signals

A business that sells or shares data must treat a widely recognised browser or device signal, such as Global Privacy Control, as a valid opt-out for that browser or device and every profile linked to it, including pseudonymous ones, and for the consumer where known. It may not ask for more than the ...

Evidence an auditor accepts: Technical design showing GPC detection at page load and suppression of selling or sharing tags; Test results from browsing with the signal enabled, including network captures; Website display of the signal status to the visitor

ISO/IEC 27701:2019 7.3.5 Providing mechanism to object to PII processing

The organization must provide a mechanism for individuals to object to the processing of their data, documenting the legal and regulatory requirements relating to objection such as objection to direct marketing, informing individuals of their ability to object in those situations, and providing a me...

Evidence an auditor accepts: Objection mechanism appropriate to each service channel; Register of the objection rights that apply, by jurisdiction and processing type; Information given to individuals about when they may object

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Consent or opt-in record · Rights request or deletion flag