Card-Show Email Consent: A Practical Vendor Guide

Separate the service request from marketing

A collector who asks for a checklist, receipt, saved cart, or inventory link is requesting a specific service. That request is not the same as asking for an ongoing series of promotions. Combining the two creates confusion and weakens trust.

Build the form around two decisions:

1. The primary request: "Email me the vendor checklist" or "Save my calculation."
2. The optional marketing choice: "Send me ClubPull's show-vendor lessons and product updates."

The primary button should complete the requested task whether the checkbox is selected or not. Do not change the button label to imply a broader agreement. Do not preselect the marketing option. This is a product and trust recommendation, not a claim that every commercial email in the United States requires advance opt-in.

The FTC explains that CAN-SPAM covers commercial messages and requires accurate headers, non-deceptive subjects, a valid postal address, a clear opt-out method, and timely honoring of opt-out requests. Other laws, states, countries, providers, and industry rules may impose additional obligations. This guide is operational education, not legal advice.

Use consent copy a person can understand in the aisle

The checkbox label should answer four questions without a privacy-policy scavenger hunt:

• Who will send the messages?
• What will the messages contain?
• How often should the person expect them?
• How can the person stop them?

Example:

Send me ClubPull's five-part show-vendor field guide and occasional product updates. This is optional. I can unsubscribe from any marketing email.

For a seller's own program:

Send me Page Collections inventory alerts, show announcements, and member offers. This is optional. I can unsubscribe anytime.

Avoid broad phrases such as "I agree to communications" or "Keep me informed." Those labels do not explain the sender, content, or purpose.

Record enough evidence to answer a future question

Store the consent state with the customer record, not only inside an email provider. A practical record includes:

• normalized email address;
• collector name when provided;
• marketing consent as true or false;
• consent timestamp;
• unsubscribe timestamp;
• form and copy version;
• event or booth source;
• landing page;
• asset requested;
• campaign parameters; and
• the system that captured the request.

Do not put an email address, phone number, or other personal information inside UTM parameters. Google Analytics documentation warns against sending personally identifiable information to Analytics. Use a non-personal event code such as orlando-card-show-2026-08 and store identity inside the protected CRM.

Read the CRM guide for the customer-record design and the email collection playbook for the full booth workflow.

Build a consent-safe data flow

Use this sequence:

1. The collector opens an event-specific destination.
2. The form validates the email and records the requested asset.
3. The system stores the capture and first-touch attribution.
4. A transactional outbox event queues the requested resource.
5. If the optional checkbox is selected, the CRM records consent and schedules the approved nurture sequence.
6. Before every nurture send, the worker reloads consent and suppression state.
7. An unsubscribe action changes the central record and prevents remaining sends.

This separation protects two promises. The resource arrives even without marketing consent, and promotional messages stop when consent is absent or withdrawn.

Train booth staff to explain the form accurately

Give staff a short script:

The email field sends the checklist you asked for. The second checkbox is optional if you also want our follow-up lessons and product updates.

Do not tell visitors that an optional checkbox is required. Do not enter an address on someone's behalf unless they can see and approve the form. If a device is shared, clear the success state before the next person uses it.

Handle transactional and promotional email differently

The immediate delivery subject should describe the requested item. Its body should provide the resource and a way to reach support. It should not become a hidden sales blast.

Marketing messages need the appropriate sender identity, postal address, unsubscribe link, and suppression checks. Use separate provider streams or tags when available so transactional delivery can be monitored independently from campaigns.

The follow-up email sequence provides a practical message plan for people who explicitly opt in.

Make unsubscribe simple and durable

Every marketing message should include a visible unsubscribe link. The action should not require a login. A signed token can identify the subscription without exposing the raw email address in the URL.

On unsubscribe:

1. validate the token;
2. mark marketing consent false;
3. record the unsubscribe time;
4. suppress all remaining nurture events;
5. keep transactional service messages available when necessary; and
6. show a clear confirmation.

The FTC says recipients must be able to opt out and opt-out requests must be honored within the required period. Operationally, ClubPull should stop queued marketing as soon as the unsubscribe is processed.

Audit the flow before each show

Test with a synthetic address and both checkbox states. Confirm that:

• the requested resource arrives in HTML and plain text;
• every link uses the production domain and HTTPS;
• unchecked consent does not schedule nurture;
• checked consent schedules the intended messages;
• the unsubscribe URL works without authentication;
• the customer record changes immediately; and
• a suppressed contact does not receive the next marketing event.

Also review reply-to behavior, sender name, mobile rendering, focus order, labels, error messages, and rate limiting. W3C guidance requires labels or instructions when content needs user input. A placeholder alone is not a durable label.

Common consent mistakes

• Prechecking the marketing box.
• Hiding recurring promotions inside a download request.
• Recording a contact without the source or copy version.
• Treating a scan as consent before a form is submitted.
• Putting personal information in analytics campaign parameters.
• Sending from a different brand than the one named on the form.
• Making unsubscribe require a password.
• Checking consent only when messages are scheduled, not again when they send.
• Assuming one country's rule covers every recipient.

Frequently asked questions

Does a QR scan count as email consent?

No. A scan only opens a destination. Consent should be tied to an understandable form action and recorded after submission.

Can I send the requested checklist without marketing consent?

Yes. Treat that email as fulfillment of the specific request. Keep it focused on the resource and do not automatically schedule recurring promotions.

What happens if an existing contact submits another form without checking consent?

Do not silently erase valid existing consent, but do not infer new consent either. Use the central customer record and an explicit policy for updates. An unsubscribe must continue to suppress marketing until the person clearly subscribes again.

How long should consent records be retained?

Retention depends on legal, operational, and privacy requirements. Define a written policy, minimize unnecessary personal data, and retain enough evidence to explain the subscription state. Obtain legal advice for your specific jurisdictions.

Use QR incentives that make the primary request worthwhile without coercing the optional marketing choice.

Sources and further reading

• FTC CAN-SPAM Act compliance guide
• W3C guidance for labels and instructions
• Google Analytics campaign URL guidance