Granular consent preferences supported

GDPR Recital 43 and Article 7 require that consent be specific — a contact agreeing to order confirmations has not agreed to promotional campaigns. ePrivacy Article 5(3) separately governs marketing communications, requiring its own specific consent. CCPA §1798.120 gives consumers the right to opt out of specific categories of data sale and sharing. A single subscribed flag collapses distinct legal bases into one undifferentiated bucket, making it impossible to honor scoped opt-outs without silencing the contact entirely. When a contact withdraws consent for marketing but not transactional emails, a system with no scope differentiation either keeps sending marketing or breaks transactional delivery.

Add a scope parameter to every consent query and enforce it at send time. Update your consent lookup function to check the exact scope before sending any campaign:

async function hasConsent(
  contactId: string,
  scope: 'marketing' | 'transactional' | 'partner'
): Promise<boolean> {
  const latest = await db
    .selectFrom('consent_records')
    .select('granted')
    .where('contact_id', '=', contactId)
    .where('scope', '=', scope)
    .orderBy('created_at', 'desc')
    .limit(1)
    .executeTakeFirst()

  return latest?.granted === true
}

Every campaign send path must call hasConsent(contactId, scope) with the specific scope for that campaign type — never check a global subscribed flag as a substitute.