Data collected for one purpose is not repurposed without separate consent

GDPR Art. 5(1)(b) prohibits using data for purposes incompatible with the original collection purpose. When a user hands you their email to receive a password reset link, they are not consenting to receive a marketing newsletter — these are legally distinct acts under Art. 6 and Art. 7. Sending marketing email to all registered users on the basis of the signup 'contract' is one of the most common GDPR violations in AI-built apps, and it is one regulators can identify from a single test signup. Passing account data to enrichment services like Clearbit or advertising audiences on Facebook without disclosure compounds the violation into an Art. 13 breach (no notice at collection).

Add a separate, unchecked marketing consent checkbox at signup. Never add users to marketing lists based solely on account creation.

<form onSubmit={handleSignup}>
  <input type="email" name="email" required />
  <input type="password" name="password" required />

  {/* Marketing consent — must default to false per Art. 7 */}
  <label className="flex items-center gap-2 mt-4">
    <input type="checkbox" name="marketingConsent" defaultChecked={false} />
    <span>Send me product updates (optional). Unsubscribe anytime.</span>
  </label>
  <button type="submit">Create account</button>
</form>

// In the signup handler, record consent separately from account creation
await db.user.create({
  data: {
    email,
    passwordHash,
    marketingConsent: formData.marketingConsent === 'on',
    marketingConsentAt: formData.marketingConsent === 'on' ? new Date() : null,
    marketingConsentVersion: '2026-02-01',
  }
})
if (formData.marketingConsent === 'on') await addToMarketingList(email)

For third-party data passes (enrichment APIs, advertising audiences), add explicit disclosure in your privacy policy and ensure a lawful basis exists separately from account delivery.