Customer data glossary

Suppression list

By Art Kukharenko · Published 2026-10-17 · Updated 2026-10-18

A suppression list is a record of identifiers that must not be contacted or processed for a stated purpose, such as people who unsubscribed, objected or withdrew consent.

Part of the Learn hub and the customer data glossary.

What it means in practice

A suppression list is the last filter before anything is sent. Entries come from unsubscribes, objections, withdrawn consent, hard bounces, spam complaints, do-not-call registers and internal decisions such as an open complaint.

Two legal anchors matter. In the EU, a person may object to direct marketing at any time, and after an objection the data may no longer be processed for that purpose (GDPR Article 21(2) and (3)) 1. In the US, CAN-SPAM makes it unlawful to send commercial email more than 10 business days after receiving an opt-out request, and unlawful to sell, lease, exchange or otherwise transfer the address of someone who opted out, except to comply with the law (15 U.S.C. § 7704(a)(4)) 2.

There is a design tension. To honour an opt-out you must keep enough data to recognise the person again, so a suppression list is retained on purpose. Hold the minimum: a normalised address or its hash, a reason code and a date.

Architecturally, one central service checked by every destination beats a copy in each tool, because copies drift. Processors that send on your behalf need the same list. A suppression is not a deletion; removing an entry means you may contact the person again.

Example (health insurance): a member opts out of marketing email. The suppression applies in every tool that can send marketing, including vendor-run mailings, while essential plan notices continue under their own legal basis.

Consent state: the record that creates entries.
Destination: where the list must be checked.
Activation: the step that applies it.
Journey orchestration: exits people mid-journey.
Data minimisation: what to store on the list.

Where it matters

Consent withdrawal across channels: a suppression architecture.
Transactional vs marketing mail separation: what suppression should not block.

Back to the customer data glossary or the Learn hub.

Frequently asked questions

How quickly must an opt-out be honoured?

US CAN-SPAM allows up to 10 business days for commercial email. GDPR sets no day count: processing for direct marketing must stop once the person objects. Aim to apply suppression immediately and everywhere.

Is a suppression list the same as deleting someone?

No. Deleting removes the person; a suppression keeps the minimum needed to avoid contacting them. If the entry is removed, you may contact them again.

Should suppression lists be shared with vendors?

Yes, with any processor or agency that sends on your behalf, under contract. Otherwise their sends can bypass the list. Share hashed or minimal identifiers where possible.

Sources

Regulation (EU) 2016/679 (GDPR), Article 21 Open source
15 U.S.C. § 7704(a)(4), opt-out requests Open source

This entry is general information, not legal advice.