# Governing customer and clienteling data through the consent lifecycle
A VIP shopper walks into a Burberry store in Milan. The associate opens a clienteling app and sees her name, her past purchases, her size, and a note: "prefers oversized trench, allergic to wool." That single screen pulls from three systems. And if this shopper unchecked "marketing emails" online last month, that note may now be a compliance breach, not a service feature.
This lesson shows you how consent, preferences, and purchase history should flow, expire, and get deleted across your systems without turning off personalization overnight.
Before consent, get the plumbing straight. Fashion retailers typically run customer data across three layers:
Data flows outward from CRM and into the associate's hand. That last hop is where governance most often fails, because a human is reading it live.
Not all customer data needs consent, and treating it as one bucket is a classic mistake.
Under the GDPR (General Data Protection Regulation), the EU law governing personal data, and the UK GDPR, you need a lawful basis to process data. The two you will meet most:
Purchase history to complete an order sits on contract as a basis. Using that same history to predict what she will buy next and email her about it is profiling for marketing, which usually needs consent.
In the US there is no single federal law. The strongest state rule is the CCPA/CPRA (California Consumer Privacy Act, amended by the California Privacy Rights Act), which gives Californians the right to opt out of the sale or sharing of their data and to request deletion. As of 2026, roughly twenty US states have comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas, and more). Treat this as an estimate and check current status, because new states pass laws each session.
The practical takeaway: a single "yes" checkbox is not enough. MapMapUsing software to automate repetitive marketing tasks and campaigns, enabling personalisation at scale across channels like email, web, and social.View full definition → each data use to its own consent or basis.
Consent must be granular and logged. When a shopper signs up in a Paris boutique, the associate's app should capture separate opt-ins:
Log each with a timestamp, the exact wording shown, the channel, and the version of the consent notice. If a regulator asks "prove she agreed," you need that record.
Consent state should live in one authoritative place, usually a consent management platform (CMP) or a dedicated table in the CDPCDPA Customer Data Platform unifies customer data from all sources into persistent, actionable profiles that other systems can use.View full definition →. Never let each system keep its own copy of "yes/no" with no sync. That is how a customer who opted out on the website still gets a text from the store.
This is the hard part. When consent changes, every downstream system must reflect it fast. A realistic target is near real time for marketing suppression and within 24 hours for analytical systems.
Here is a simplified consent record and a suppression check:
consent = {
"customer_id": "C-88421",
"email_marketing": False, # opted out 2026-03-01
"sms_marketing": True,
"style_profiling": True,
"updated_at": "2026-03-01T09:14:00Z"
}
def can_send(channel, consent):
return consent.get(f"{channel}_marketing", False)
can_send("email", consent) # False -> suppress
can_send("sms", consent) # True -> allowedThe clienteling app should call the same source. If the associate sees a "send lookbook by email" button, it must be greyed out for this customer.
Consent is not forever. Some regulators and many internal policies treat consent as stale after a period of inactivity (commonly cited as 12 to 36 months, a policy choice, not a fixed legal number in most cases). If a customer has not engaged in, say, 24 months, you re-permission (ask again) rather than keep emailing.
Preferences also decay. A "prefers slim fit" note from 2021 may be wrong. Tag preferences with a source and date so associates know how fresh a note is.
When someone exercises their right to erasure (the GDPR "right to be forgotten") or a CCPA deletion request, you must delete their personal data across all systems, including backups within a reasonable window, and including that clienteling note about the wool allergy.
Exceptions exist: you can retain what you need for legal or tax reasons (order records for accounting). So "delete" often means "delete marketing and profiling data, retain minimal transaction records under a documented retention rule."
For the official text on erasure obligations, see the EU's own guidance on the right to erasure.
The fear is that consent kills personalization. It does not, if you separate uses.
A customer can opt out of email marketing but still allow style profiling for in store service. In that case:
This is why granular consent matters commercially. Bundle everything into one switch and a single opt-out wipes out your entire relationship. Split it, and you keep the service layer alive.
Governance is only real if you test it. Run these regularly.
Pick a sample of customers who opted out. Confirm they received zero marketing across email, SMS, and push in the following 30 days. A simple metric:
Suppression accuracy = (opted-out customers with zero sends) / (total opted-out customers)
Worked example: you sampled 500 opted-out customers. 497 received nothing; 3 got an email. Accuracy = 497 / 500 = 99.4%. Anything below 100% is a breach candidate; investigate the 3.
List every data use (recommendation engine, lookbook emails, associate notes, partner sharing) and confirm each maps to a documented lawful basis. Any use with no mapping stops until fixed.
Submit a test erasure request and trace it. Did the CDPCDPA Customer Data Platform unifies customer data from all sources into persistent, actionable profiles that other systems can use.View full definition →, CRMCRMCustomer Relationship Management: software and strategy to manage and analyse customer interactions throughout their lifecycle.View full definition →, and clienteling app all purge? Did the data reappear from a nightly batch feed the next morning? Reappearance is the most common failure.
Flag preferences and consent records older than your policy threshold. Report the percentage of active profiles with stale consent.
Knowledge check
1. A shopper unchecks 'marketing emails' online, but a store associate's clienteling app still displays a note used to tailor promotional outreach to her. Why does this represent a compliance risk rather than good service?
2. Why is the 'last hop' from CRM/CDP into the associate's clienteling app described as where governance most often fails?
3. A retailer processes purchase history to fulfill an order and run fraud checks without asking the customer to opt in. Which lawful basis best justifies this, and why?
4. Select ALL correct answers about the distinction between consent and legitimate interest as lawful bases under GDPR.
Select all the correct answers.
5. Select ALL correct answers about the three data layers a fashion retailer governs.
Select all the correct answers.
Governance needs named owners, not committees.
The regulators enforcing this include national Data Protection Authorities in the EU (France's CNIL, Ireland's DPC, which oversees many large firms headquartered there), the ICO (Information Commissioner's Office) in the UK, and state Attorneys General plus the California Privacy Protection Agency in the US. GDPR fines can reachreachThe number of unique people exposed to your message in a given period. Unlike impressions, reach counts each person once, no matter how often they see it.View full definition → up to 4% of global annual revenue, a genuine board-level risk for a large fashion house.