Consent and Suppression Checks Before Send: What an AI Agent May and May Not Do

Who this is for: DPOs, compliance leads and marketing-operations leads. Confirm that your send step enforces consent by rule, decide whether a reviewing agent adds anything, and run the 13 test cases in the consent withdrawal article. The method is part of AI agent rails.

The rule first: a model never decides who may be contacted

A model never decides who may be contacted, and this is the one point to take from the page. A wrong "allow" can be unlawful, and the message cannot be recalled. Consent must be exact and explainable, and a probabilistic answer is neither. Rule 5 of 7 things AI agents should never do says agents never modify consent or suppression state. The same holds for a suppression list check before send and for any pre-send compliance check.

Before: the manual workflow

Manual consent checking usually means trusting each sending tool's own list. Someone exports a segment, a marketer ticks "exclude unsubscribed", and the send goes out days later. Lists drift, and nobody compares them until a complaint arrives. When a regulator asks why one person received one message, the answer has to be rebuilt by hand.

What rules do and what the model does

Rules enforce consent at three points, and the model only explains what those rules found. Remove the third layer below and the system is still safe. Remove the first and no agent can save it.

The mechanics of layers 1 and 2 are in the suppression architecture. The next table shows who owns each task.

What counts as a consent conflict?

A consent conflict is any case where the planned message and the recorded consent state disagree. The rows below draw on the consent withdrawal article's test cases, and a rule or job catches each one first where it can.

Why can the hold only tighten?

A hold can only tighten because a release would be a consent decision. A hold is reversible and only delays a send. So the agent may raise one at L4 within written limits, and only a person may clear it. A hold never overrides a rule-based deny, and clearing a hold does not create an allow, because the send-time check still runs.

The hold service checks the written criteria and the daily limit, so the model cannot raise a hold outside them. The session reads sensitive conflict data and can change one narrow piece of state, which is two of the three Rule of Two properties 1. It reads structured conflict data with no free text, so it never holds the third. See rail levels for how L4 is earned.

Free-text objections are a separate rail

Free-text objections need their own rail, because people object in support tickets, not in forms. An agent such as the Escalation Spotter can help find them. That session reads untrusted text, so it holds no hold rights and no consent tools. It flags the case to a person, who records the objection through the normal source.

GDPR Article 21 still applies once the objection is raised, so the flag cannot become a slow path. Test case 3 in the consent withdrawal article covers exactly this route.

After: the job on rails, step by step

The job on rails adds an explanation to checks that already run, and it changes no consent state at any step.

1. A journey is submitted for launch, or a reconciliation report arrives.
2. Rule checks run and produce conflict categories and counts.
3. The agent receives categories and counts, with pseudonymised samples only where a case needs them.
4. It writes a plain explanation, a rule reference and a proposed fix.
5. If written criteria match, it raises a hold through the hold service.
6. A compliance reviewer accepts or rejects the fix and clears any hold, with a reason.
7. The rule layer enforces at send regardless of anything above.

The rail card

The rail card fixes what the Consent Conflict Reviewer may do, and a filled copy comes with the template. The rail card guide explains the fields.

The agent runs on a private model inside the customer environment, with no external model for this data.

What the ledger shows for one run

One hold leaves one record, with identifiers by reference and no personal data. The ledger writer creates it outside the agent. The record below is illustrative, with example value values.

{
  "record_id": "aud_001377",
  "event": "consent.hold.raised",
  "rail": "consent-conflict-reviewer@v2",
  "rule_version": "consent-rules-2026.4",
  "conflict": {"id": "cfl_0093", "category": "destination_out_of_sync", "count": 412},
  "journey": {"ref": "jrn_218@v3", "sha256": "be02..."},
  "hold": {"id": "hld_0041", "raised_at": "<timestamp>", "criteria": "crit_07@v2"},
  "cleared": {"by": "compliance_02", "at": "<timestamp>", "reason": "destination re-synced; check ref cc_9012"},
  "ledger": {"prev_hash": "c301...", "hash": "e77a..."}
}

Three ways it fails, and the control for each

A consent agent fails by sounding sure, by holding too often, or by acting like a lawyer, and each control below sits outside the model.

Metrics that are honest

Honest consent metrics measure the rules first and the agent second. Only the last two below depend on the agent.

• Withdrawal-to-suppression time per destination. Aim for minutes, as the consent withdrawal article advises.
• Drift found per reconciliation.
• Test-case pass rate each quarter, across all 13 cases.
• Conflicts caught before launch against those blocked at send.
• Hold precision: holds a reviewer agreed with, as a share of all holds. Report by rail and role. Annex III point 4(b) of the EU AI Act lists monitoring workers' performance as a high-risk use 2, so take advice before tracking named reviewers.

Which legal clocks apply to a consent check?

The legal clocks are set out in the consent withdrawal article's table, which covers GDPR Article 7(3) and Article 21, ePrivacy Article 13, CAN-SPAM, CASL, the TCPA and mailbox-provider rules. They run whether or not an agent exists, and an agent does not extend them.

How vendor tools compare

Most vendor tools handle the list and do not address an agent's role, so use them for layers 1 and 2. We opened these pages on 1 November 2026, and features may exist that they do not describe.

An agent is optional here, and many teams should skip it. If you run one sending platform with few conflicts, the rules and a monthly review are enough. Add a reviewer when conflicts are frequent and people spend real time working out what each one means. PrivyCDP's product page describes an immutable audit ledger that records each AI-assisted action with the human or system actor that authorised it.

Checklist

• ☐ Every sender calls a send-time decision check, and it fails closed for marketing.
• ☐ Consent and suppression live in one system of record.
• ☐ No agent has a write path to consent or suppression state.
• ☐ Destinations are reconciled against the ledger nightly.
• ☐ Templates are tagged as marketing, service or legal notice.
• ☐ The 13 test cases have run this quarter, with results on file.
• ☐ Only a named person clears a hold, with a reason logged.
• ☐ Free-text objections reach a person quickly through a separate rail.

For where this job sits among the others, read AI agents for marketing operations and transactional and marketing mail separation, or return to the AI agent rails hub. To write this rail for your own team, download the rail card template.