Separate a preference from contact validity
W3C privacy principles discuss meaningful user choice; they do not define legal consent for your business. This engineering example has a locally approved rule: an authoritative opt-out cannot be reversed by an older import. Do not infer marketing permission from a nonblank email field.
| Field | Example | Meaning |
|---|---|---|
| purpose | marketing-email | Not a universal all-contact flag |
| decision/revision | opt-out / 6 | Latest authoritative decision under local rule |
| source/evidence_ref | preference-centre / PREF-63 | Traceable decision, not copied private text |
| incoming import | opt-in / 4 | Stale; cannot override revision 6 |
Quarantine a conflict rather than granting permission
Treat unrecognised purpose, absent provenance or incomparable revisions as unresolved. Stop the affected marketing export under the approved policy until the owner resolves it. Review the actual legal/business rule separately; timestamps alone do not establish valid consent.
An import created today contains a preference collected months earlier. Is its import time the preference time?
Show the worked answer
No. Keep collected decision time and import time separate. Apply the approved provenance/version rule; a newer file arrival does not prove a newer user choice.