Shopify email consent — collect it right, sync it everywhere

Merchant scenario: supplement brand's consent audit after complaint spike

A $92k/mo supplement Shopify store ran Klaviyo email, Postscript SMS, and Privy popups without a documented consent architecture. EU traffic was roughly 18% of sessions. Checkout marketing checkbox was unchecked by default — good — but the Privy spin-to-win popup bundled email entry with marketing consent in rules text below the fold. A German customer complained to their supervisory authority after receiving three promotional emails without remembering an explicit opt-in. Parallel issue: 4,200 Klaviyo email subscribers had been bulk-tagged for Postscript SMS during a Black Friday "sync for urgency" hack. Complaint rate on SMS hit 0.08% in one week; Gmail began throttling marketing domain reputation on email side effects.

Remediation took eleven business days. Privy popup rebuilt with separate unchecked marketing checkbox and EU geo branch to double opt-in. Postscript list rebuilt from checkout SMS consent and keyword opt-ins only — 4,200 profiles removed, 890 re-collected over six weeks. Klaviyo integration audit confirmed Shopify marketing_consent property mapping with timestamp. Consent log exported: source URL, capture type, timestamp per profile. Complaint rate normalized within 21 days. Legal inquiry closed with documented remediation. The merchant's finance team later modeled consent hygiene as deliverability insurance — one supervisory inquiry cost more operations hours than a year of compliance tooling.

90-day rollout: consent architecture from zero documentation

Days 1–14: Inventory every capture point — Shopify checkout, footer forms, Privy/Justuno popups, landing pages, SMS keyword paths, post-purchase account creation. Screenshot each with consent language. Export sample profiles from ESP showing consent properties present or missing. Document lawful basis per segment in one-page internal memo (not legal advice — operational record).

Days 15–30: Fix highest-risk capture first — usually popup and SMS. Verify Shopify → ESP sync on staging customer: create test order with marketing opt-in, confirm property in Klaviyo or Sequenzy within 60 minutes. Test unsubscribe round-trip: ESP unsub must reflect in Shopify customer marketing status. Add physical address and one-click unsubscribe to all templates if missing.

Days 31–60: SMS consent rebuild if email list was ever imported to SMS platform. Run Postscript or Omnisend SMS compliance audit. Configure quiet hours. Separate transactional from marketing templates. EU segment: enable double opt-in for unknown geo or explicit EU shipping addresses. Privacy policy update listing processors.

Days 61–90: Quarterly audit calendar in ops doc. Re-permission protocol for 180-day non-openers who remain subscribed. Migration checklist updated to exclude unsubscribed and complaint profiles. Train agency or freelancer on consent metadata requirements for any new popup. Deliverability cross-read: consent failures and complaint spikes are the same dashboard.

Margin math: consent compliance cost versus complaint and churn loss

Model three numbers monthly: complaint rate (target under 0.03%), unsubscribe rate on first send to new captures (target under 0.5% for clean consent), and SMS opt-out rate (target under 2% on promotional sends). A 0.08% complaint spike on 200,000 monthly sends = 160 complaints — enough to trigger Gmail postmaster warnings and suppress inbox placement for 30–45 days. Revenue impact at 22% email attribution on $92k/mo store: roughly $6,800–$14,000 monthly drag depending on severity.

Double opt-in reduces list growth 15–35% but improves first-send engagement 40–80% in our workflow tests — net revenue often flat or positive within 90 days because fewer dead profiles inflate send cost and hurt reputation. TCPA SMS settlement exposure dwarfs ESP subscription fees; treating Postscript compliance audit as $0 insurance is false economy. Privy popup rebuild costing four hours of operator time ($300 labor) versus one deliverability recovery project ($2,000–$8,000 agency warmup) is obvious ROI.

Consent documentation also reduces migration risk: clean exports with consent timestamps accelerate ESP switches without re-permission campaigns. Importing 12,000 profiles without provable consent forces sunset or double opt-in anyway — delaying revenue from those profiles 30–60 days. Build consent right at capture; fixing retroactively is always more expensive.

Failure rehearsal: consent disasters we see before peak season

Pre-checked popup after theme refresh. Developer duplicated checkout checkbox styling to popup; marketing opt-in defaulted checked. EU complaints within 72 hours. Fix: quarterly popup audit including mobile rendering; never inherit checkout CSS defaults for consent UI.

ESP migration reactivates unsubscribed. CSV column mapping treats "unsubscribed" as blank → subscribed. 600 emails to users who opted out two years ago. Fix: migration dry-run on 50 profiles; verify suppression count matches source platform before bulk import.

Giveaway email ≠ marketing consent. Contest entry requires email; marketing sends begin without checkbox. Fix: separate entry confirmation from newsletter opt-in; tag giveaway entrants without marketing consent as transactional-only until explicit opt-in.

Delayed unsubscribe sync. Klaviyo unsub does not sync to Shopify for 96 hours; Shopify Email or secondary tool still sends. Fix: test bidirectional sync weekly; single source of truth for marketing suppression.

SMS quiet hours ignored during flash sale. Promotional texts at 10pm local trigger opt-out surge. Fix: enforce quiet hours in Postscript; schedule urgency for next morning or use email for overnight windows.

Consent architecture is not legal-only paperwork — it is deliverability infrastructure. Profiles without documented consent produce higher complaint rates, which throttle inbox placement for your entire list including engaged buyers. Treat consent sync verification as weekly ops alongside revenue reporting. When EU traffic exceeds 15% of revenue, budget counsel review annually; when SMS exceeds 20% of attributed recovery, budget TCPA audit before scaling volume. Re-permission campaigns are surgical tools for engaged-ish inactives — not list resurrection for cold imports. Every consent fix should be measurable within 30 days: complaint rate down, first-send engagement up, support tickets about unwanted messages down.

Shopify theme changes are silent consent killers. Checkout extensibility updates, third-party payment flows, and international market expansions can break marketing checkbox sync without visible frontend changes. Add consent sync verification to every theme launch checklist — same priority as broken add-to-cart. Document consent source tags in ESP for every capture point so two years from now nobody wonders why a segment exists. Source tags cost five minutes at setup and save weeks during migration or audit. International merchants should geo-segment at capture when possible — EU double opt-in, US single opt-in with engagement monitoring, Canada CASL documented consent — rather than one-size-fits-all popup logic that satisfies no jurisdiction fully. Privy and Justuno templates should be audited after every edit — marketing teams love to bury consent in incentive copy during conversion experiments.