2.2 Consent Management & Preference Enforcement in Data Cloud

Consent Management & Preference Enforcement in Data Cloud

In an enterprise Customer Data Platform, possessing a unified customer identity does not confer an unrestricted license to communicate. Knowing a customer's email address, mobile number, and purchase history is legally inert without verifiable, active consent. A core responsibility of a certified Data Cloud consultant is configuring the Consent Data Model, harmonizing preferences across disparate touchpoints, and enforcing automated suppression within the segmentation engine before audience payloads leave the platform.

---

The Data Cloud Consent Data Model

Salesforce Data Cloud models privacy and preferences through the Customer 360 Canonical Data Model, specifically within the Consent subject area. This framework mirrors the Salesforce Core CRM Individual and Consent data architecture, establishing a standardized relational schema across brands and channels.

Individual DMO (Master Identity & Global Privacy Flags)
  │
  ├── Contact Point Consent DMO (Channel Endpoint Level: Email, Phone, Address)
  │     └── PrivacyConsentStatus: OptIn | OptOut | Seen | NotSeen
  │     └── EffectiveFromDate / EffectiveToDate
  │
  └── Communication Subscription Consent DMO (Topic / Brand Level: "Weekly Deals")
        ├── Communication Subscription Channel Type DMO
        └── Data Use Purpose DMO (Legal Basis & Purpose: "Marketing", "Billing")

Key Consent Data Model Objects (DMOs)

---

Opt-In vs. Opt-Out Regimes Across Channels

Different communication channels operate under fundamentally divergent regulatory frameworks. Consultants must design consent capture and suppression logic tailored to channel-specific statutory standards:

1. Email Channel

• United States (CAN-SPAM Act): Operates primarily on an opt-out regime for commercial messages. Marketers may send commercial messages without prior explicit opt-in, provided the email contains clear identification, a physical postal address, and a functional, honored opt-out mechanism (processed within 10 business days).
• European Union (GDPR) & Canada (CASL): Require strict affirmative opt-in before sending commercial emails. Pre-checked boxes and implied consent are legally invalid. CASL distinguishes between express consent (perpetual until revoked) and implied consent (valid for 2 years following a transaction).

2. SMS and Mobile Messaging

• United States (TCPA - Telephone Consumer Protection Act): Strict prior express written consent is legally required before transmitting marketing text messages using automated telephone dialing systems. Violations carry statutory penalties of $500 to $1,500 per unauthorized message. Implied consent is prohibited for promotional SMS.

3. Mobile Push Notifications

• Governed by mobile operating system permissions (iOS APNs / Android notification runtime permissions) combined with application-level subscription consent captured in Communication Subscription Consent.

4. Digital Advertising & Paid Media (AdTech)

• CCPA/CPRA "Do Not Sell or Share My Personal Information" (DNS): Consumers have the right to prohibit sharing their personal data for cross-context behavioral advertising. In Data Cloud, receiving a DNS flag or Global Privacy Control (GPC) signal must immediately trigger suppression from downstream activation targets (such as Google Ads Customer Match, Meta Custom Audiences, or Amazon Ads).

---

Filtering and Segment Suppression Based on Consent Flags

A critical failure point in Customer Data Platform implementations is relying on downstream execution systems (like Marketing Cloud or ad platforms) to handle consent filtering. A Data Cloud consultant must configure segment definitions to enforce consent suppression directly at the segmentation boundary.

Direct vs. Related Attribute Filtering

In the Data Cloud Segment Canvas, attributes are evaluated based on their relationship to the segment anchor (typically the Unified Individual DMO):

• Direct Attributes: Global flags on the Individual DMO (e.g., HasOptedOutOfEmail EQUALS False or DoNotTrack EQUALS False). These represent 1:1 attributes directly attached to the profile.
• Related Attributes: Records residing in child DMOs with 1:N cardinality, such as Contact Point Consent or Communication Subscription Consent.

The Cardinality and Stale Record Trap

Because a customer may opt in in January, opt out in March, and opt back in in June, an Individual often has multiple historical Contact Point Consent records.

Customer Record: John Doe
  ├── Contact Point Consent Record 1 (2024-01-01): PrivacyConsentStatus = 'OptIn'
  └── Contact Point Consent Record 2 (2025-06-15): PrivacyConsentStatus = 'OptOut'

[!CRITICAL] If a consultant constructs a segment condition: Contact Point Consent.PrivacyConsentStatus EQUALS 'OptIn', the query engine checks if any child record meets the criteria. Because Record 1 matches 'OptIn', the query evaluates to TRUE, inadvertently including an individual who actively opted out in Record 2!

The Architectural Solution: Always construct segment logic using a dedicated Exclusion Container:

1. Inclusion Criteria: Target audience criteria (e.g., high-value loyalty tier, recent purchase).
2. Mandatory Inclusion Rule: Related Attribute Contact Point Consent has PrivacyConsentStatus EQUALS 'OptIn' AND EffectiveToDate >= TODAY.
3. Exclusion Container: EXCLUDE any audience member where Contact Point Consent.PrivacyConsentStatus EQUALS 'OptOut' OR Individual.HasOptedOutOfEmail EQUALS True OR Individual.DoNotTrack EQUALS True.

---

Synchronization Across Systems & Preference Centers

Consent must remain synchronized across the enterprise ecosystem. If a consumer updates their preferences in an external portal, the update must propagate through Data Cloud and down to activation targets without lag.

1. External Preference Centers (OneTrust, TrustArc, Web Portals): Capture consumer preference updates and push them into Salesforce via the Data Cloud Ingestion API or Salesforce CRM standard objects.
2. Salesforce Core CRM Sync: The standard Salesforce CRM Connector streams the Core Individual, ContactPointTypeConsent, and DataUseLegalBasis objects directly into Data Cloud standard DLOs, mapped 1:1 to canonical consent DMOs.
3. Consent Reconciliation in Identity Resolution: When Identity Resolution merges multiple source contact profiles into a single Unified Individual, privacy preferences can conflict. Consultants must enforce a Most-Restrictive (Conservative) Governance Policy: if any merged profile has an active opt-out flag (OptOut), the Unified Profile must treat the individual as opted out for that channel. Never use 'Last Updated' or 'Most Frequent' for consent reconciliation if doing so risks overwriting an explicit legal opt-out.