Can opt-out, do-not-contact or unsubscribe flag from a CRM be fed to an AI tool?

Yes, under the existing purpose and with the model provider under a processor agreement.

Every field · Consent, preferences and rights

Opt-out, do-not-contact or unsubscribe flag

Q: Is opt-out, do-not-contact or unsubscribe flag personal data?

Personal data. An opt-out is a right being exercised (Art. 21, CPRA 1798.120). It must be honoured across every channel and never lost in a deletion.

An opt-out is a right being exercised (Art. 21, CPRA 1798.120). It must be honoured across every channel and never lost in a deletion.

personal data

personal data?

standard

sensitivity

usable

AI use

legal obligation (honouring objections)

lawful basis usually relied on

Keep it how long

Keep indefinitely as a suppression record; never delete an opt-out.

The gap we see most

Opt-outs deleted with the contact, so the person is re-imported and re-emailed from another list.

What holding it is evidence for

Requirement text and artefacts from a human-verified corpus licensed to Field Register.

Opt-out and objection flags GDPR Art.21 · CCPA/CPRA §1798.120 · CCPA/CPRA CCR §7026 · CCPA/CPRA §1798.135(b) · ISO/IEC 27701:2019 7.3.5

GDPR Art.21 Right to object

Where processing is based on the performance of a public interest task, official authority or legitimate interests, including profiling on those bases, the data subject may object at any time on grounds relating to their particular situation, and processing must stop unless the controller demonstrat...

Evidence an auditor accepts: Objection records that distinguish direct marketing objections, which are absolute, from Article 21(1) objections, which are balanced; The compelling legitimate grounds analysis for every Article 21(1) objection that was refused; Evidence the right to object was presented clearly and separately at first communication, such as the template or screen as sent

CCPA/CPRA §1798.120 Right to Opt Out of Sale or Sharing of Personal Information

Consumers have the right, at any time, to direct a business that sells or shares PI about the consumer to third parties to stop selling or sharing the consumer's PI. Businesses that sell or share PI of consumers under 16 must obtain opt-in consent (parent/guardian if under 13). Once a consumer opts ...

Evidence an auditor accepts: Do Not Sell or Share My Personal Information mechanism; Age verification and opt-in records for minors; 12-month re-solicitation cooldown tracking

CCPA/CPRA CCR §7026 Requests to Opt-Out of Sale/Sharing Handling

A business shall act upon a request to opt out as soon as feasibly possible, but no later than 15 business days from the date of receipt. Business shall notify all third parties to whom it has sold or shared PI within 90 days prior to receipt of request to cease selling or sharing. Opt-out shall not...

Evidence an auditor accepts: Opt-out SLA tracking (15 business days); 90-day downstream notification log to third parties; Adtech partner suppression confirmation

CCPA/CPRA §1798.135(b) Opt-Out Preference Signals (Global Privacy Control)

A business that sells or shares PI shall process an opt-out preference signal (such as Global Privacy Control) sent with the consumer's consent through a platform, technology, or mechanism, indicating the consumer's intent to opt out of sale or sharing. The signal shall be treated as a valid consume...

Evidence an auditor accepts: GPC/opt-out signal detection logic in web stack; Test evidence showing signal honored across browsers and devices; Suppression flag propagation to adtech vendors

ISO/IEC 27701:2019 7.3.5 Providing mechanism to object to PII processing

The organization must provide a mechanism for individuals to object to the processing of their data, documenting the legal and regulatory requirements relating to objection such as objection to direct marketing, informing individuals of their ability to object in those situations, and providing a me...

Evidence an auditor accepts: Objection mechanism appropriate to each service channel; Register of the objection rights that apply, by jurisdiction and processing type; Information given to individuals about when they may object

Do this for your whole CRM

Paste your field list and get this classification for every field at once, with the record of processing per object, the gaps, and the controls the register is evidence for. No account for the first run.

Build my field register

Consent or opt-in record · Rights request or deletion flag