Global unsubscribe suppresses all campaign types

GDPR Article 7(3) states that a data subject has the right to withdraw consent at any time and that withdrawal must be as easy as giving consent — a global unsubscribe that silently leaves other campaign lists active violates this requirement. ePrivacy Article 5(3) applies separately to marketing communications. CCPA §1798.120 gives consumers the right to opt out of all sale and sharing, not selected categories. Multi-list email platforms (Mailchimp, Klaviyo, HubSpot) default to list-scoped unsubscribes, which means a contact who clicks the standard unsubscribe link in a newsletter will continue receiving promotional and partner emails unless the sending path explicitly checks for global suppression first.

Add a global suppression guard as the first check in every send path, before any scope-specific consent lookup:

// src/lib/campaigns/can-send.ts
async function canSendCampaign(
  contactId: string,
  scope: string
): Promise<boolean> {
  // Global suppression always overrides scope consent
  const globalSuppression = await db
    .selectFrom('opt_outs')
    .select('id')
    .where('contact_id', '=', contactId)
    .where('scope', '=', 'global')
    .where('active', '=', true)
    .executeTakeFirst()

  if (globalSuppression) return false

  return hasConsent(contactId, scope)
}

When a contact triggers a global unsubscribe (via List-Unsubscribe header or "unsubscribe from all" action), insert a revocation record for every active scope, plus one with scope = 'global'. Verify that every send path in src/ calls canSendCampaign() — grep for any path that calls hasConsent() directly without the global guard.