The accounts you need
For each country you sell in, make one account per choice the form offers. Give each the country when you create it (Add account, then Country), so its persona lives there.
| Account | At sign-up | What it checks |
|---|---|---|
| Declined | Left marketing unticked | No marketing arrives, where consent is needed first |
| Opted in | Ticked marketing | Marketing arrives, with an unsubscribe link and the sender’s details |
| Pre-ticked | Left a box that started ticked | In the EU and UK, that isn’t consent: no marketing should follow |
| Not confirmed | Ticked marketing, but didn’t confirm the email | In Germany, or where your project requires double opt-in, no marketing before confirming |
| Unsubscribed | Opted in, then unsubscribed | Marketing stops in time |
| Under-age | A persona of 12 (UK) or 15 (EU) | Consent from a child needs a parent’s |
| Declined, in Singapore | Left marketing unticked | Anything it gets starts its subject with <ADV> |
Set them up
- Create the accounts with a country each, and a date of birth for the under-age one.
- Sign up each one on your staging site. Before submitting, note whether the marketing box was already ticked.
- Record what each agreed to: in the account’s sheet, open Consent and set marketing, whether the box was pre-ticked, and double opt-in. Agents and tests use
record_consent(MCP),PUT /v1/addresses/{address}/consent(REST),recordConsent(Node.js and the mobile helpers) orrecord_consent(Python). - Trigger the marketing: a newsletter, an offer, an abandoned cart.
The rules
Every check names the rule, the place and its source, with the date we checked it: 19 Oct 2026. Rules that depend only on what was recorded fail; guesses from the email’s text only warn.
| Check | Where | The rule | Source |
|---|---|---|---|
marketing_consent |
EU and EEA, UK, Canada, Australia, New Zealand, Switzerland, Japan, South Korea | Marketing email needs prior consent (the UK and EU allow a soft opt-in for existing customers). In the US, Singapore and Hong Kong it’s skipped: they’re opt-out | ePrivacy Directive, Article 13; ICO; ISED; ACMA; DIA; UCA Art. 3(1)(o); Specified Electronic Mail Act; Network Act, Art. 50 |
prechecked_consent |
EU and EEA, UK | A pre-ticked box isn’t consent | CJEU, Planet49; ICO |
double_opt_in |
Germany (a warning), or any project that requires it (a failure) | Email advertising needs prior express consent the sender can prove; confirming by email is the usual proof | UWG § 7 |
unsubscribe_deadline |
US, Canada, Singapore, Hong Kong: 10 business days; Australia, New Zealand: 5; EU, EEA, UK, Switzerland, Japan, South Korea: promptly | Marketing after an unsubscribe warns inside the time allowed and fails after it. Weekends are skipped; public holidays aren’t | FTC; ISED; ACMA; ICO; DIA; Spam Control Act; UEMO, Cap. 593 |
postal_address |
US, Canada | The email gives a postal address (a warning: found by reading the text) | FTC; ISED |
sender_identity |
All of the above | The From line names the sender (a warning) | FTC; ISED; ACMA; ICO; DIA; UCA Art. 3(1)(o); Specified Electronic Mail Act; Network Act, Art. 50; Spam Control Act; UEMO, Cap. 593 |
minor_marketing |
UK (under 13), EU and EEA (under 16; a member state may set 13 to 15) | Consent from a child to an online service needs a parent’s (a warning) | ICO; GDPR, Article 8 |
misleading_subject |
US, Canada, Hong Kong | No subject that starts like a reply or forward (Re:, Fwd:) when it’s marketing, and no same-day deadline (“last day”, “ends tonight”) when the email’s coupon lasts days longer (a warning: read from the subject) |
FTC; Washington RCW 19.190.020; California § 17529.5; Competition Act s. 74.011; UEMO, Cap. 593 |
ad_label |
Singapore | Commercial email to someone who didn’t agree to it, sent in bulk, starts its subject with <ADV> (a warning: whether it was bulk isn’t known) |
Spam Control Act |
What to check
- Nothing without consent: the declined and pre-ticked accounts get no marketing where consent comes first (the EU, UK, Canada, Australia, New Zealand, Switzerland, Japan and South Korea), while receipts and security emails still arrive.
- Confirmation first: where you use double opt-in, nothing arrives before the confirmation link is used.
- Honest subject lines: a subject that says the sale ends today matches the offer in the email, and nothing pretends to be a reply.
- Unsubscribe in time: after unsubscribing, marketing stops well inside the deadline. Mark the account as unsubscribed in the inbox, and any later marketing is flagged.
- Who it’s from: every marketing email names the sender and, for the US and Canada, gives a postal address.
The emails to check
Each marketing email’s checks show in the inbox and on the Accounts page’s Marketing row, and Reports collects the failures. The checks run on what arrived: they don’t see what your app stored, so record consent as the person chose it on the form.
This is a test aid for your own app on staging, not legal advice.