Purchased list age verification

GDPR Art. 5(1)(d) requires that personal data be kept accurate and up to date. Purchased contact lists degrade rapidly — industry benchmarks cite 22–30% annual data decay on B2B contacts. Importing a 6-month-old list without a date check means you are processing data the vendor has already cycled out, inflating your bounce rate and contacting people who have changed roles or departed. GDPR Art. 13 requires you to inform data subjects of the data source; stale lists may have been collected under expired consent. CCPA §1798.100 adds a parallel obligation to ensure data accuracy.

Add an age validation step to every list import path that rejects lists exceeding 90 days since collection date. The validation must run before any records are inserted.

// src/lib/list-import/validate-age.ts
export function validateListAge(collectedAt: Date): void {
  const ageDays = (Date.now() - collectedAt.getTime()) / 86_400_000
  if (ageDays > 90) {
    throw new Error(
      `List is ${Math.round(ageDays)} days old. Purchased lists must be collected within the last 90 days (GDPR Art. 5(1)(d) accuracy requirement).`
    )
  }
}

Record the collected_at date on the import job row so compliance teams can audit which lists were accepted and when.