Customers
Consent, quiet hours and do-not-contact
What may be sent, to whom, at what hour in their own time zone — and why the evidence matters more than the answer.
Three regimes have to be satisfied at once and they do not agree with each other. So none of this is a rule about a country written into the code — it is contact rules, rows you edit, resolved most-specific-wins exactly as leave policy and overtime rules are.
Consent is a record, not a tick
A consent record stores the answer, the channel, the purpose, how it was obtained and the exact wording somebody was shown. Withdrawal posts a new record rather than editing the old one, so the history reads as a sequence of decisions.
Why the wording is stored
Under GDPR the answer on its own is not a defence. What matters is what was in front of the person when they agreed — and a checkbox that has been reworded three times since cannot tell you which version they saw. Overwriting the old record on withdrawal would destroy the same evidence, which is why it is insert-only in spirit, like the leave ledger.
Only marketing needs consent in advance
A message about work already agreed is a different question from a message trying to sell something. Treating them alike is how a product ends up unable to email somebody about their own order.
Quiet hours are in the recipient's time zone
Not yours, and not the server's. A window that wraps midnight — nine in the evening to eight in the morning — is the normal case and is handled as such.
An unknown time zone refuses the send
TCPA damages run to $1,500 per message and are not capped, so a guess is not a cheap mistake. A country is not a time zone in the United States, Canada, Russia, Brazil or Australia, and for those the answer is *unknown* rather than a plausible one. The refusal says so, and it tells you what to record to fix it.
Refusals are ordered by how permanent they are
- They asked not to be contacted. Stated by a person, and nothing overrides it.
- No address on file.
- No consent recorded for this channel and purpose.
- Quiet hours, with the time it stops applying.
Somebody who has asked never to be contacted must not be told to try again at eight.
Recording a call is a stricter question
Eleven US states require every party to consent to a recording and four more are unsettled. The contact rule carries the answer for each jurisdiction you operate in, so you record your own reading rather than inheriting ours — and where notice is required, the rule says so before the call rather than after it.
Do-not-contact on a company covers everybody at it
It is a decision made by the organisation, and a per-person opt-out cannot express it. Marking the company takes effect on its people immediately, because reachability is computed on every read rather than stored.