Consent management

This guide introduces consent management.

Consent management helps you handle subscription policies and track consent changes for every customer. This feature ensures compliance with data protection regulations while giving you full visibility into customer preferences.

With consent management, you can:

• Define custom consent categories for customer subscriptions.
• Set subscriptions based on legitimate interest.
• View the complete consent history for every customer, including who gave or withdrew consent, when, and where.
• Provide a customizable consent management page for your customers.
• Control whether Bloomreach tracks opens and clicks for each recipient, using tracking consent categories.

How consent management works

Consent management is enabled by default for all new projects. The system tracks every consent interaction and stores it in the customer profile, creating an auditable trail of all consent activities.

You can manage consents in three ways:

• Directly in the customer profile interface.
• Through automated scenarios using consent events.
• Through customizable consent management pages that customers access themselves.

Each consent has a status (granted or revoked), a category, and an optional expiration date. The system automatically tracks the source, timestamp, and any changes to consent status over time.

Consent categories

Consent categories help you organize data into multiple groups, each with its own consent status and approach to data processing and communication. This structure lets you communicate with each customer according to their specific preferences.

Bloomreach offers three types of categories:

• General consent: Broad consent covering multiple communication types.
• Consent: Specific permission for defined activities.
• Legitimate interest: Processing based on legitimate business interest rather than explicit consent.

Learn more about these categories and their configuration in the Consent categories article.

Manage consents in the customer profile

You can monitor and manage each customer's consents in their profile, where consents appear as attributes. The profile overview shows the consents granted and revoked, the current status of every consent the customer gave, and the full history. It also shows details such as the source of each consent and its expiration date.

To review and manage a customer's consents:

1. Go to Data & Assets > Customers, and open the customer profile.
2. Click the Consents tab.
3. In the Consents section, review the status of each consent category. A green check mark means the consent is granted, and a red cross means it's revoked.
4. To revoke all of the customer's consents at once, click Revoke all consents.

Manage consents through a scenario

You can modify consent by creating events in a scenario.

To add a consent event to a customer profile:

1. Add an Add event node to your scenario. For example, connect it to the Yes output of a Condition node that targets the customers whose consent you want to change.
2. Enter a name for the node.
3. Select consent as the event.

To grant valid consent, specify three mandatory event properties in the consent event. If a property is missing, click Add event property:

• action (accept or reject): Depends on whether you want to grant or revoke the consent.
• category (name of the consent category): You can retrieve this name from Project settings > Privacy management > Consents, where you can see the name of a particular consent category. This is important because the consent name shown in the UI when you select it can be different.
• valid_until (UNIX timestamp or unlimited): If you're granting consent, you can specify when it expires. Use a UNIX timestamp for a specific expiration date, or use unlimited if you want it to last forever. The valid_until property is needed only when you're granting consent. If you're rejecting consent, it isn't a mandatory event property.

Bloomreach sets the timestamp of the event automatically. Because consents are tracked automatically, it also adds the source (scenario), identification_type (application), and identification (the scenario ID) attributes.

Tracking consent

Tracking consent controls whether Bloomreach tracks opens and clicks for each recipient. It doesn't control whether a message is sent. Learn how to set it up in Configure tracking consent categories.

If a recipient withdraws consent after you send an email, opens and clicks on that email can still be recorded. Don't use them for profiling or targeting.

Limitations

Legacy projects: If your project was created before May 1, 2018, it originally used campaign groups instead of consent categories. To migrate to the new consent management system, go to Project settings > Privacy management > Consents. When you enable consent categories, the system automatically maps and migrates your campaign groups to consent categories. After the migration, the Old campaign group column in the Consents table shows which campaign group each consent category belonged to.

Once you enable consents in your production project, you can't trigger any campaign that was historically linked to a campaign group until you load valid consents. You also can't reverse the campaign groups functionality once you enable consent categories.