Guide · June 17, 2026
Sync consent with CRM/CDP to market only to consenting users
Guide to syncing consent with CRM/CDP/email tools, market only to opt-ins and update immediately on withdrawal.
Quick answer
What is syncing consent with CRM/CDP and why do it?
Syncing consent with CRM/CDP turns agree/withdraw states into operational data: CRM knows who can be called, CDP knows who can be targeted, and the email tool knows who can receive campaigns. Without syncing, you can end up with one place showing a withdrawal while another system still runs a campaign.
For Vietnamese businesses, this is not just a technical issue. Under the Personal Data Protection Law (Law 91/2025/QH15, expected to take effect 01/01/2026, replacing Decree 13/2023/ND-CP), businesses must have an appropriate processing basis and manage withdrawal of consent as prescribed. The enforcement authority is the Ministry of Public Security — Department of Cybersecurity and High-Tech Crime Prevention (A05).
Which fields should be synced between the consent platform and CRM/CDP/email tools?
You should sync at least the following fields for safe operations with sufficient traceability:
consent_status: agreed / withdrawn / undefined.consent_scope: email marketing, SMS, remarketing, partner sharing, etc.consent_timestamp: most recent time of consent.withdrawal_timestamp: most recent time of withdrawal.source: web form, app, POS, call center, landing page.policy_version: policy/notice version at the time of consent.proof_idorevent_id: proof identifier for traceability.
If you only store “opt-in = true/false,” that’s often insufficient for internal audits. When there’s a complaint, you need to prove what the person consented to, when, via which channel, and how it was updated when they withdrew.
| Data field | CRM | CDP | Email tool | |
|---|---|---|---|---|
| Consent status | Required | Required | Required | |
| Consent scope | Recommended | Required | Required | |
| Time of consent/withdrawal | Required | Required | Required | |
| Source of collection | Required | Recommended | Recommended | |
| Evidence/log | Recommended | Required | Recommended | |
| Suppression list (suppression list) | Required | Recommended | Required |
What does the consent sync process with CRM/CDP look like?
Choose a source of truth:
Prefer a consent platform or an internal service dedicated to managing consent; don’t let CRM and the email tool “guess” the status.
Standardize consent events:
Each consent/withdrawal event must have user ID, channel, purpose, timestamp, version, and event ID.
Push status to related systems:
Sync to CRM, CDP, email tool, ad platforms, and call center lists via API or webhook.
Apply suppression immediately:
When consent is withdrawn, add the user to the suppression list and remove them from all ongoing marketing workflows.
Log changes:
Store who changed what, when, and which systems received updates before/after, for traceability in case of disputes.
Periodic checks:
Randomly reconcile between the consent source and downstream systems to detect status drift.
How do you update on withdrawal without missing any system?
Short answer: design a “withdraw-first” flow, meaning withdrawals are prioritized for immediate processing before any other marketing tasks. When a withdrawal signal arrives, the system should do three things simultaneously: update the central status, emit events to relevant tools, and block any pending send jobs.
Real-world example: customer A signs up for promos via a landing page, then clicks the “unsubscribe” link in an email. If the email tool stops sending on its platform but CRM still keeps marketing_allowed = true, sales might continue adding them to a call sequence. At that point, you’re no longer truly syncing consent across CRM/CDP/email tools.
From a compliance standpoint, if a personal data breach occurs, the company must notify within 72 hours of discovery as required. Therefore, the consent system should alert when it detects status mismatches or mis-sent messages.
What technical architecture should SMEs and dev teams design?
For SMEs, there’s no need to over-engineer from day one. A minimal model should be:
- Consent service: stores canonical consent status.
- Event bus/webhook: emits
consent.granted,consent.withdrawnevents. - Sync workers: push updates to CRM/CDP/email tools.
- Suppression store: a suppression list used by all campaigns.
- Audit log: records change history and the versions of notices/terms.
If your stack includes tools like HubSpot, Salesforce, Klaviyo, Mailchimp, or an in-house CDP, don’t sync by “running a nightly batch.” Consent can be withdrawn at any time; the longer the delay, the higher the risk.
Common mistakes when syncing consent with CRM/CDP
The most common pitfalls are:
- Only updating consent in forms but not in CRM.
- Having email opt-out but still running SMS or remarketing.
- Not storing evidence of consent, only the checkbox.
- Not differentiating each processing purpose.
- No shared suppression list.
- Not testing the end-to-end consent withdrawal flow.
If your ad platform or email tool has a tracker/pixel, focus on transparency, notice, and consent management as required, rather than asserting the tool is “illegal.” If used for marketing based on personal data, consult a lawyer to review scope and processing bases.
- Yes. If you only update CRM/CDP but the email tool still keeps the user in a send list, you can still send to someone who has withdrawn consent.
- Not always; the business must consider retention purposes, processing bases, and legal obligations as prescribed. But you must stop marketing and block processing for the withdrawn purpose.
- It may work at a very small stage, but it’s error-prone and hard to audit. With CRM/CDP/email tools, use APIs, webhooks, and change logs to reduce sync misses.
- When you change forms, switch tools, add new marketing channels, or after a complaint/data incident. If an incident occurs, consider seeking legal advice early.
If you need a cookie banner template, a schema for storing consent evidence, or a DSAR/withdrawal flow for your product, consent.vn can help you standardize before implementation.
Source: the Personal Data Protection Law (Law 91/2025/QH15) thuvienphapluat.vn; Decree 13/2023/ND-CP thuvienphapluat.vn; A05 bocongan.gov.vn
Get started — set up in 5 minutes.
Deploy PDPL solutions for your business?