Opted-out users not re-subscribed without fresh affirmative consent

CAN-SPAM §5(a)(4) and TCPA §227 prohibit re-adding users to marketing lists after they have opted out, unless they give fresh affirmative consent. A user import script that upserts with marketingOptOut: false for every row silently re-subscribes everyone who previously opted out — this is one of the most common AI-built app violations because the import code is often generated without awareness of the suppression table. GDPR Art. 7(3) is equally explicit: withdrawal of consent must not be overridden by subsequent data operations.

Use upsert update blocks that never touch the marketingOptOut field, and cross-reference your suppression list before any bulk send.

// scripts/importUsers.ts — preserve opt-out on upsert
for (const row of csvRows) {
  await db.subscriber.upsert({
    where: { email: row.email },
    create: { email: row.email, name: row.name, marketingOptOut: false },
    update: {
      name: row.name,
      // Never include marketingOptOut here — preserve whatever is in the DB
    },
  })
}

// Before any bulk campaign: filter against suppression
const suppressed = new Set(
  (await db.subscriber.findMany({ where: { marketingOptOut: true }, select: { email: true } }))
    .map(s => s.email)
)
const recipients = allRecipients.filter(r => !suppressed.has(r.email))

Apply the same logic to account reactivation flows: never reset notification preferences to defaults.