Consent and compliance
Handling Withdrawal of Consent and Opt-Outs
Every gambling marketing message needs a simple way to opt out, and the opt-out has to take effect across all systems within the market's deadline. The deadlines differ: the US and Canada allow up to 10 business days, Australia 5 working days, and the British gambling code says "as soon as practicable".
In short
- Offer a way to withdraw consent in every marketing message; the British gambling code requires it each time a consumer is contacted.
- Honor opt-outs within the market deadline, and aim for much faster.
- An objection to all direct marketing is absolute under the UK GDPR.
- Record each withdrawal as an event so every system and every future import respects it.
Scope and limits. Covers marketing opt-outs. Self-exclusion is a different process with stricter rules; see suppression for self-exclusion and objections. Not legal advice.
Deadlines by market
| Market | Rule | Source |
|---|---|---|
| Great Britain (gambling licensees) | If consent is withdrawn, the licensee must "as soon as practicable" ensure the consumer is not contacted with electronic marketing | Gambling Commission SR code 5.1.11 |
| United States (commercial email) | "You must honor a recipient's opt-out request within 10 business days." | Federal Trade Commission (FTC) guide to the CAN-SPAM Act |
| Canada (commercial electronic messages) | Senders must "stop sending them CEMs within 10 business days" | Canadian Radio-television and Telecommunications Commission (CRTC) guidance on implied consent |
| Australia (commercial electronic messages) | A message must offer an unsubscribe that "honours a request to unsubscribe within 5 working days" | Australian Communications and Media Authority (ACMA) |
| Ontario (gambling) | Players "must be provided a method to withdraw their consent at any time" | Alcohol and Gaming Commission of Ontario (AGCO) Standard 2.07 |
These are outer limits. A modern stack can apply an opt-out in minutes, and a customer who opts out and then receives another promotion the same day is likely to complain whatever the legal deadline. The consent rules behind each deadline are compared in the four-market consent rules comparison.
What counts as an opt-out
- An unsubscribe link or button in an email.
- A STOP-style reply to a text message. The Information Commissioner's Office (ICO) notes that "With text messages you could offer an opt-out by telling people to send a stop message to a code number."
- A change in the preference center.
- A request by phone, chat or email to customer support.
- A broad request such as "stop contacting me", which should be treated as an objection to all direct marketing.
The ICO's consent guidance says people "must be able to withdraw consent easily at any time." Do not ask for a password, a reason or a second confirmation before the opt-out takes effect. The matching layout for the account area is in preference center layout.
Objections are absolute
Under the UK GDPR, the right to object to direct marketing has no exceptions. The ICO says: "This is an absolute right and there are no exemptions or grounds for you to refuse." Record an objection as its own event that blocks all direct marketing, and keep it on the suppression list described in how suppression records work.
Making the change stick
- Write the withdrawal to the permission store first, then confirm to the customer.
- Emit an event that every channel tool consumes; see propagating preference changes.
- Cancel any queued sends for that product and channel.
- Match future imports against the opt-out, so the person is not re-added from another source.
Opting back in
A customer who opted out can opt in again later through the same affirmative process as a new customer. Code 5.1.11 says the licensee must not contact them with electronic marketing after withdrawal "unless the consumer consents again". Record the new consent as a fresh event with its own wording; do not restore the old one.
Channel-specific rules for email and text messages, including what a footer must contain, are in email and SMS rules for gambling automation.
Opt-outs received by staff
Customers often ask to stop marketing in a chat, a phone call or an email to support. Give staff one action that records the request with the customer as source and the staff member as actor, and that applies it at once. Do not ask the customer to repeat the request through a link. A record of who took the request and when is part of the evidence described in consent audit trails.
Questions
Can we ask why a customer is opting out?
You can offer an optional question after the opt-out has been applied, but the opt-out must not depend on an answer.
Does an email unsubscribe also stop text messages?
Not automatically, unless the customer asked to stop all marketing. Make the scope clear on the confirmation page and offer a link to the full preference center.
Sources
- Gambling Commission, LCCP Condition 5.1.11 - Direct electronic marketing consent, no date shown.
- Information Commissioner's Office, What is valid consent?, page dated August 4, 2026 (under review after the Data (Use and Access) Act).
- Information Commissioner's Office, Right to object, page dated March 25, 2025 (under review after the Data (Use and Access) Act).
- Federal Trade Commission, CAN-SPAM Act: A Compliance Guide for Business, published August 9, 2023, edited January 2024.
- Canadian Radio-television and Telecommunications Commission, Canada's Anti-Spam Legislation (CASL) Guidance on Implied Consent, no date shown.
- Australian Communications and Media Authority, Avoid sending spam, no date shown.
- Alcohol and Gaming Commission of Ontario, Registrar's Standards for Internet Gaming, marketing and self-exclusion sections updated May 14, 2026.
Every source was read on October 28, 2026. How we choose sources: data sources.
Safer gambling support is listed on the safer gambling page.