Re-Permission Emails: When You're Allowed to Ask for Consent by Email
A re-permission email asks people on your list to confirm they still want your mail, and only works for people you're already allowed to email. UK regulators treat an email asking for marketing consent as marketing itself: in 2017 the ICO fined Flybe and Honda for sending exactly those emails to people who hadn't consented. Send re-permission mail only to subscribers whose consent is old or poorly recorded, verify the list first, and keep only the people who click.
The question comes up in r/Emailmarketing whenever someone inherits an old list: "Can I just email everyone once and ask if they want to stay?" The answer depends on who "everyone" is.
What the ICO decided
From the ICO's announcement of 27 March 2017 (official press release, as republished):
| Flybe | Honda Motor Europe | |
|---|---|---|
| Fine | £70,000 | £13,000 |
| Emails | More than 3.3 million | 289,790 |
| What they asked | "Are your details correct?", sent to people who had opted out | Whether customers wanted to hear from Honda |
| ICO finding | "deliberately contacted people who had already opted out" | Couldn't show the recipients had consented |
The ICO's then head of enforcement: "Sending emails to determine whether people want to receive marketing without the right consent, is still marketing", and "Businesses must understand they can't break one law to get ready for another."
The rules the ICO enforced were the UK's Privacy and Electronic Communications Regulations (PECR). EU countries have similar rules under the ePrivacy Directive. The US CAN-SPAM Act is opt-out based and works differently. This isn't legal advice; check the rules where your recipients are.
Who a re-permission email is for
| Segment | Send a re-permission email? |
|---|---|
| Subscribed with consent, but no record of when or how | Yes, to document consent |
| Subscribed with consent, not mailed for a long time | Yes, before you restart |
| Customers emailed under the soft opt-in, moving to a new brand or new kind of mail | Usually yes; the new mail may not be covered |
| Opted out or unsubscribed | No |
| Bought, rented or scraped addresses, or no idea where they came from | No. You need consent before the first email, not after |
For the restart itself, our post on mailing an old email list has a five-stage plan.
Clean the list before you ask
Re-permission sends go to the oldest, least engaged part of a list, which is where the dead addresses are. AWS's SES spam-trap guidance recommends sending an opt-in message and keeping only those who click, but adds: "we don't recommend using this technique if you think that your mailing list might contain a lot of bad addresses, or if your account already has a problem with bounces".
- Verify every address on the verify page. Remove invalid, disposable and dead-domain results.
- Hold catch-all addresses back or send them last, in a small batch.
- Send in batches, most recent signups first, and stop if the bounce or complaint rate climbs. The spam complaint rate calculator shows where each batch sits against Gmail's 0.3% line.
What to write
- Subject: plain and honest, e.g. "Do you still want emails from [brand]?". Not "Are your details correct?"; the ICO case shows a disguised marketing question is still a marketing question.
- First line: who you are and how they joined ("You signed up on our website in 2023").
- What they'll get: topics and frequency.
- One button: "Yes, keep me on the list."
- What happens otherwise: "If you don't click, we'll stop emailing you after [date]." Then do it.
- No offer or promotion in the body, and a working unsubscribe link anyway.
Send one reminder at most, then move everyone who didn't confirm to your suppression list. Record each confirmation with the date and the wording shown, which is the consent record you were missing. Double opt-in on new signups keeps you from needing this again.
Where SimpleVerifier fits
Verification removes the addresses that would bounce or are disposable before the re-permission send. It can't tell you who consented; that's your records. The first 100 checks are free with a Google sign-in on the verify page. Pro is $39 a month with the first 100,000 checks a month at full speed, then slower, never cut off, and one-time packs of 10,000 checks for $15 never expire. See pricing.
Common questions
Can I email people to ask if they want to receive marketing?
In the UK, not if you don't already have consent (or a valid soft opt-in) to email them. The ICO treated Flybe's 'Are your details correct?' and Honda's 'Would you like to hear from Honda?' emails as marketing that needed consent. Other countries' rules differ; check the law where your recipients are. This isn't legal advice.
Who can I send a re-permission email to?
People you can lawfully email today whose consent you want to refresh or document better: old signups without a timestamp, subscribers you haven't mailed in a long time, or a list moving to a new brand. People who opted out stay out.
What should a re-permission email say?
Who you are and how they ended up on the list, what you'll send and how often, one clear confirm button, and what happens if they don't click (you'll stop emailing them). Keep it plain and short, with no promotion in it.
Should I verify the list before a re-permission campaign?
Yes. Re-permission sends usually go to the oldest part of a list, which has the most dead addresses. Amazon SES's guidance on opt-in confirmation messages warns against that approach if a list might contain a lot of bad addresses or the account already has a bounce problem, so remove them first.
Check your list before you send
Real mailbox checks over SMTP, and nothing is sent to the address. Sign in with Google and your first 100 email checks are free, no card. Plans for bigger lists are on the pricing page.