Marketing consent for push and email without getting blocked

Push and email are high-leverage until they are not. One promotional send to users who never opted in can tank domain reputation, trigger App Store scrutiny, and burn support time on “how do I stop these notifications?”

Rheo Engage sends marketing email and push from the same profile you use for Analytics and Convert. Engineering owns the consent contract: what you store, when you set it, and how segments respect it before any broadcast or automation fires.

This post covers consent models, SDK and server patterns, segment guardrails, and operational checks: without pretending legal advice replaces your counsel.

Three layers of permission

Confusion comes from stacking unrelated gates:

Layer	What it is	Governs
OS / platform	iOS notification permission, Android 13+ runtime permission	Whether the OS will show a push
Product marketing consent	Your recorded opt-in for promotional messages	Whether Rheo Engage may send marketing
Transactional / relationship	Receipts, security, subscription status	Often exempt from marketing rules: still use sparingly

Analytics may run under a different consent banner on web (analytics vs marketing). Do not assume analytics acceptance equals marketing opt-in.

Email: marketing vs transactional

Message type	Examples	Typical consent
Transactional	Password reset, receipt, billing failed	Account relationship
Product / lifecycle	Trial ending, export ready	Often allowed; check policy
Marketing	Promos, newsletters, feature hype	Explicit marketing opt-in

Rheo Engage marketing email steps should target profiles where marketing_email_consent (or your equivalent trait) is true. Store when and how consent was collected for audit.

Implementation pattern

1. Collect consent in onboarding (Convert flow checkbox) or account settings: not pre-checked in regulated regions.
2. Persist on the Rheo customer profile via SDK identify traits or dashboard update API.
3. Segment all Engage email audiences with marketing_email_consent = true.
4. Honor unsubscribe: Rheo handles list hygiene for marketing sends; automations must stop promotional branches on unsubscribe events.

Deliverability basics

Practice	Why
Verified sending domain (SPF, DKIM, DMARC)	Inbox placement
Separate subdomain for marketing	Protect transactional mail
Warm new domains gradually	Avoid sudden volume spikes
Bounce and complaint monitoring	SES and provider dashboards

Transactional mail on the root domain and marketing on mail.yourapp.com is a common split.

Push: OS permission is not marketing consent

Users can allow notifications for order updates and still reject promos. Best practice on iOS and Android:

1. Request OS permission with clear value (often after in-app proof, not first launch).
2. Record marketing_push_consent separately when user toggles “Offers and tips” in settings.
3. Engage push steps require both valid device token and marketing consent true.

State	OS push	Marketing consent	Engage marketing push
A	Denied	any	No
B	Allowed	false	No
C	Allowed	true	Yes
D	Allowed	true but stale token	No until refresh

Refresh tokens on app launch; clear token on logout.

Pre-prompt and Convert flows

Many teams use Convert to run ATT-style education for tracking and a separate screen for notification value before the system dialog. Branch grant vs deny paths so users who refuse OS push still get email journeys if consented.

Web: cookies, banners, and double opt-in

Web apps often need:

• Analytics consent (measurement cookies / SDK init deferred).
• Marketing consent (email capture on signup).

Align with consent-first product analytics for web and mobile if that post is live in your queue; the principle is the same: no SDK side effects before the choice is recorded.

For EU audiences, double opt-in for email marketing remains common. Flow:

1. User submits email with checkbox.
2. Send confirmation link (transactional).
3. Set marketing_email_consent only after confirm.

Automations should not fire promotional steps between steps 1 and 3.

Storing consent on the unified profile

Rheo’s value is one ID across analytics events, flow participation, and Engage history. Consent traits belong on that profile:

Trait	Type	Notes
marketing_email_consent	boolean	Source: signup, settings
marketing_email_consent_at	datetime	Audit
marketing_push_consent	boolean	Product-level
marketing_push_consent_at	datetime	Audit
locale	string	Jurisdiction-specific copy

Use consistent naming in SDK and server updates. Changing trait names without migration breaks segments silently.

Segment guardrails in Engage

Every broadcast and automation audience should include consent filters by default. Templates for teams:

Journey	Minimum segment filters
Weekly product email	marketing_email_consent + not unsubscribed
Trial nurture push	marketing_push_consent + trial active
Win-back	consent + lapsed subscriber trait from billing integration

Add frequency caps in product policy: e.g. max one marketing push per 48 hours per user. Implement via automation design (do not re-enter within window) or custom traits last_marketing_push_at.

Consent withdrawal

Users must be able to withdraw as easily as they opted in:

Channel	UX	System
Email	Unsubscribe link	Webhook or provider sync → trait false
Push	In-app settings toggle	Trait false; optional local unregister
All	Account deletion path	Profile delete per your DPA

Automations should listen for consent false and exit or skip pending sends.

Testing without poisoning production

Environment	Practice
Development	EMAIL_SEND_MODE=log or sandbox inboxes
Staging	Separate Engage workspace or test app
QA devices	Dedicated test profiles with consent true

Never run marketing broadcasts against production “all users” from a test dashboard.

Checklist before first marketing send

• Legal reviewed message categories for your markets
• SPF/DKIM/DMARC valid on sending domain
• Traits set on identify from app and web
• Segments include consent predicates
• Unsubscribe and push settings wired to traits
• Sample users in EU and US tested end-to-end
• Runbook for mistaken send (pause automation, apology broadcast to affected only)

How this fits Rheo Analytics and Convert

Analytics measures behavior under analytics consent. Convert captures opt-in UI in flows you can change without app store release. Engage executes only when traits prove marketing permission.

Billing tools (RevenueCat, Stripe) remain authoritative for paid status; consent gates promotional contact, not “your subscription renewed” receipts.

Getting consent right is not a one-time form field. It is schema, segments, and automation design. Teams that treat it as engineering work ship faster on lifecycle messaging without getting blocked: by users, providers, or regulators.

Start for free