Grant

A small importing family hired Grant to "review" the subscriber list they'd inherited when they bought a competitor. Fifty thousand contacts, accumulated over a decade through unclear consent practices. Some had explicit double opt-in records. Many didn't. A few looked like they'd been added via business-card capture at trade shows, with a casual "we'll add you to our newsletter" that may or may not have been agreed to.

The family wanted to send their first big campaign as the new owners. They thought of the list as an asset.

Grant told them the list as it stood was a liability, not an asset. Sending to fifty thousand contacts whose consent was unclear would tank the family's domain reputation in a single campaign. The previous owner had been getting away with it for years because the previous owner's domain reputation was already half-collapsed and they'd stopped caring. The family didn't have that luxury.

He walked them through a re-permission campaign. One careful email to all fifty thousand. Clear note about the change of ownership, what the brand stood for now, and a simple ask: if you'd still like to hear from us, click here. If not, no hard feelings, you'll be removed.

The response rate was 36%. Eighteen thousand people clicked through. The remaining thirty-two thousand were suppressed.

The family balked. Eighteen thousand felt like a loss. Grant explained that the eighteen thousand were now the most engaged list in their industry, because every one of them had actively chosen this version of the brand. Open rates ran 42% on the next campaign. Conversion rates were three times what the previous owner had been seeing.

Within two years the family's brand reputation in the trade was one of the strongest. The lesson he teaches now: consent re-confirmed is consent strengthened. A list of eighteen thousand who chose you is worth more than a list of fifty thousand you inherited.

---

A new sender Grant advised had a single welcome email. It said "Thanks for subscribing" and contained a discount code. That was the entire welcome experience.

He redesigned it.

Email one was the actual welcome. It thanked the subscriber by name, reaffirmed what they'd signed up for, set clear expectations on what they'd receive and how often, and gave them an easy preference link to adjust if they wanted to.

Email two arrived four days later. It was a piece of the brand's best content, the kind of thing that showed why being on the list was actually worth the inbox space.

Email three arrived a week after that. It asked the subscriber to choose preferences. What categories of content did they want? How often? Did they want product news, or just stories?

Email four was a reply-friendly note from the founder, asking what the subscriber was hoping to get out of the relationship.

Email five was the first regular newsletter, formatted like every weekly send would be from then on.

The welcome series open rates ran 62%. Industry average for welcome sends is in the high 40s, but most senders see lower because their welcome series consists of one weak email. The new welcome did three things at once: it set the contract for the relationship, it gave subscribers a way to shape the experience, and it filtered. The 38% who didn't open had self-identified as not really interested. Fine. Suppress at 14 days of zero engagement, save the deliverability. The lesson he teaches now: welcomes are the contract. The relationship you have with a subscriber for the next three years is signed in the first three weeks.

Grant's intro:

I want to start with what permission isn't. Permission isn't a checkbox. Permission isn't a buried clause in the terms of service. Permission isn't an "unsubscribe link in the footer." Permission isn't "you gave us your card at the conference." All of those things are paperwork. Permission is something different. Permission is a memory.

---

When someone gives you their email address, they are doing something specific. They are saying yes to a relationship. They are choosing to let you into their inbox, which is the most personal piece of digital real estate most people have. They are placing a small but real amount of trust in you to use that access well.

That's the agreement. Permission is the word we use for that agreement.

It has three layers. Most senders only think about the first one.

Explicit. The subscriber actively chose to give you their email. They typed it into a form. They confirmed it. They were told what they'd receive. They knew what they were saying yes to. There was no ambiguity about whether they wanted this.

Informed. They understood what the agreement included. They knew the brand. They knew what kind of content. They knew the rough cadence. They weren't tricked into it by a "subscribe to our newsletter to enter the giveaway" mechanic that buried the consequence.

Reaffirmed. The agreement gets refreshed over time. Long-term subscribers get asked, periodically, whether they still want to be there. The subscriber's consent isn't treated as a one-time signature on a contract that runs forever, it's treated as an ongoing relationship that the sender keeps current.

Most senders stop at the first layer, and even there they cut corners. They use pre-checked boxes. They bury the agreement in legal text. They say "by entering the giveaway you agree to receive our newsletter" without making the second part of that sentence as visible as the first. That's not permission. That's manufactured consent, and it doesn't hold up legally, technically, or ethically.

---

Why does permission matter?

Three reasons, in order of how much they cost when ignored.

One, it's the law in most places. GDPR in Europe requires explicit, informed, freely-given consent that can be withdrawn as easily as it was given. CASL in Canada requires opt-in (not opt-out) for commercial email, with documented consent records, and the fines for violation top out at $10 million per violation. CAN-SPAM in the United States is more lenient, allowing opt-out rather than opt-in, but it still requires accurate sender identification, a clear unsubscribe path, and prompt honoring of opt-out requests. The legal landscape is messy and the rules differ, but the trend is universally toward stricter consent, not looser.

Two, mailbox providers care about it. Gmail, Microsoft, Yahoo, and Apple all use complaint rates as one of their primary signals for inbox-vs-spam decisions. A complaint happens when a recipient marks an email as spam. The single largest source of complaints is mail sent to recipients who don't remember subscribing. Lower permission quality leads directly to higher complaint rates leads directly to worse deliverability. Permission isn't just an ethical issue, it's a deliverability issue, and the math is unforgiving.

Three, it's the foundation of every other thing you do in email. Beautiful design doesn't matter if recipients don't trust the sender. Personalization doesn't matter if the recipient never asked to be on the list. Content quality doesn't matter if the relationship started with deception. Permission is the load-bearing wall under everything else. Cracks in the wall show up everywhere.

---

How do you build permission well?

The mechanics aren't complicated. The discipline is.

Use clear opt-in. A form field that says "join our newsletter" is permission. A pre-checked box buried under three other things is not. If a subscriber would be surprised to receive your email, the consent is broken.

Tell them what they're getting. "Join our newsletter" is weak. "Get a weekly product update and an occasional offer, never more than three emails a week" is strong. Specificity reduces complaints, because people get what they expected.

Use double opt-in for serious lists. Send a confirmation email asking the subscriber to verify. Yes, you'll lose the people who put in a typo or who weren't really committed. Those weren't subscribers. They were noise. Double opt-in lists outperform single opt-in lists by 2-3x on engagement.

Document the consent. When did they sign up? What form? What language was on the form at that time? What IP address? Save these. When someone files a CASL complaint or a GDPR data request, you'll need the records.

Honor unsubscribe immediately. If a subscriber asks to leave, they should be off your list within hours, not weeks. Delayed unsubscribe is a complaint waiting to happen.

Re-permission audit twice a year. Anyone who hasn't engaged in 12-24 months should be asked, with a single direct email, whether they still want to hear from you. The ones who say yes are the ones you keep. The ones who say nothing are the ones who stopped being subscribers a long time ago, the system just hasn't acknowledged it.

---

Permission done well looks quiet. Subscribers who chose you stay. They open. They click. They reply. They don't complain. Mailbox providers see the engagement signal and reward you with inbox placement. Lawyers see the records and don't need to call. The ship runs honestly.

Permission done poorly looks loud. Complaints stack up. Open rates drop. Mailbox providers tighten the screws. Lawyers send letters. Subscribers who don't remember subscribing tell their friends not to use you. The damage compounds slowly until the day it doesn't.

Permission is a memory. The subscriber remembers, or they don't. If they remember and they still want to be there, you have a relationship. If they don't remember, the relationship doesn't exist, and treating it like it does is what gets senders into trouble.

Welcome aboard. Welcome them properly.

- Grant

Grant's intro:

The welcome is the most important email you will ever send to a subscriber. It's the contract. It says this is who we are, this is what you'll get from us, this is how often, and this is how to leave if it ever stops being right. Everything you send for the next three years is read through the lens of what the welcome promised. Most senders use a single weak welcome email and wonder why their list never warms up. Here's how to do the welcome well.

---

A welcome series is a sequence of emails sent automatically when someone subscribes. It runs for the first two to three weeks of the relationship, separate from your normal cadence. Its job is to set expectations, deliver value early, and earn trust. Done well, it produces the highest engagement rates of any send your brand will ever do. Welcome series open rates routinely run 50-70%, while industry-average open rates are in the 20s.

That gap exists because new subscribers are paying attention. They just chose you. They're curious about what they signed up for. They have not yet developed the inbox-blindness that long-term subscribers eventually develop. The welcome window is the most attentive your audience will ever be.

Wasting that window on a single "Thanks for subscribing!" email is one of the most common mistakes I see.

Here's the structure that works.

Email one: the actual welcome (sent immediately on signup)

The first email arrives within minutes of the subscriber clicking subscribe. It does four specific things.

It thanks them by name. Not "Dear Subscriber." Their actual first name if you have it, or a warm greeting if you don't.

It reaffirms the agreement. It reminds them what they signed up for, in clear language. "You're now subscribed to the [name] newsletter, where I share [specific topic] every [cadence]." This is the moment to set expectations, because the subscriber is still attentive enough to read them.

It gives them an easy preference link. A single button or link that lets them adjust frequency, topic, or unsubscribe entirely. Yes, even now. Subscribers who can adjust their experience stay longer than subscribers who can't.

It delivers something useful. Not a discount code (those train subscribers to wait for discounts). A real piece of content. A guide. A useful link. A small but genuine value handoff. The first email is when you prove the relationship is worth their inbox space.

That's email one. Brief, warm, useful.

Email two: brand voice (sent 3-4 days after signup)

The second email shows the subscriber what your voice sounds like when you're not introducing yourself. This is a piece of your best content. The thing that, when you wrote it, made you proud. A great essay, a useful tutorial, a story from your work, a hard-won lesson written in plain language.

The job of this email is calibration. The subscriber learns what to expect from your regular sends. They learn your tone, your perspective, your value-density. If they like what they read here, they'll read what you send for years. If they don't, they'll quietly disengage and the system will eventually suppress them, which is also fine.

Don't sell in this email. Don't pitch. Just show what your voice does at its best.

Email three: ask for preferences (sent 7 days after signup)

By day seven, the subscriber has read the welcome and a piece of your real content. Now you ask them to shape the relationship.

The third email contains a small preference center. Three or four questions, no more.

What categories of content do they want to receive? (If you have multiple themes, let them pick.)

How often do they want to hear from you? (Weekly, bi-weekly, monthly. Some senders offer "occasional only.")

Do they want product news, or just stories? (Or whatever the equivalent split is for your brand.)

The preference center has a real impact on long-term retention. Subscribers who actively chose their preferences are 40-60% more engaged a year later than subscribers who never adjusted anything. The preferences also let you tailor sends, which improves engagement on every send going forward.

Don't make preferences exhaustive. Don't ask for demographics. Don't ask for purchase history. Ask only for what affects what they actually receive.

Email four (optional): community or social proof (sent 10-14 days after signup)

This one is optional. It works for some brands and not others.

If your brand has a community (a Slack, a Discord, a forum, an event), invite them. If your brand has notable customer stories, share one. If your brand has a useful piece of social proof (a press mention, a milestone, a testimonial), introduce it here.

The job is to broaden the relationship beyond just the email channel. Subscribers who connect to your brand through multiple channels are dramatically more loyal than subscribers who only know you through email.

If this email feels forced for your brand, skip it. Four-email welcome series work fine. Five-email welcome series work fine. The number isn't sacred.

Email five: the first regular send (sent ~14 days after signup)

The final email of the welcome series isn't really part of the series. It's the first regular send, formatted exactly the way every regular send will be from now on. Same template. Same tone. Same length. Same call-to-action style.

The handoff from "welcome experience" to "regular cadence" should feel seamless. The subscriber doesn't notice the transition because the welcome series prepared them for exactly what they're now getting.

By the end of week two, you have a subscriber who knows your voice, has chosen their preferences, has received real value from you, and trusts that you won't surprise them with what they signed up for.

---

A few details that matter.

Suppress non-engagers. If a subscriber hasn't opened a single email in the welcome series after 14 days, they're not really a subscriber. Move them to a "watching" segment, send one re-engagement attempt at day 30, and suppress if no response. They self-identified as not really interested. That's fine. The welcome series filtered, which is also part of its job.

Don't put discounts in the welcome. Discounts in welcomes train subscribers to wait for discounts. They condition the wrong behavior. If you want to offer something exclusive, offer it in your regular cadence after the relationship is established.

Use the subscriber's name when you have it. If you don't have a first name, don't fake one. "Dear FNAME" is a worse failure than "Hi there." A clean greeting beats a broken merge field every time.

Test, but conservatively. Welcome series performance is high-leverage. A 5% improvement on welcome engagement compounds into significant retention improvements over a year. Test small things. Subject lines, send times, preference center wording. Don't redesign the entire series on a whim.

---

The welcome series is your handshake. It's the first impression that determines what every subsequent email is read against. Senders who treat it as a single "Thanks for subscribing!" email are leaving the most engaged moment in their list's lifetime on the table.

Welcome them properly. The relationship you build in the first three weeks lasts for years.

- Grant

Grant's intro:

A small importing family hired me to "review" the subscriber list they'd inherited when they bought a competitor. Fifty thousand contacts, ten years of unclear consent, and a campaign launching in two weeks. They thought of the list as an asset. I told them it was a liability. Here's what I told them next, and why the eighteen thousand we ended up with was worth more than the fifty thousand they started with.

---

You took over an email list you didn't build. Maybe you bought a company. Maybe you took over a marketing role. Maybe a colleague left and the list is now yours. You don't know how the addresses got there. You don't know what was promised at signup. You don't know which contacts gave explicit consent and which were added through some grey-area mechanism nobody documented.

Sending to that list as-is is a mistake.

The reason isn't ethical, though there's an ethical case too. The reason is operational. An inherited list of unknown consent quality, sent without remediation, will produce a complaint rate above 1%, hit any spamtraps that have been seeded over the years, and damage the receiving sender's domain reputation in a single campaign. That damage takes months to recover from. The supposed asset becomes a domain-burning weapon, except it burns the sender's own domain.

The honest path through is a re-permission campaign. Here's how it works.

Step 1. Acknowledge what you have

Pull the full inherited list. Get a count. For each address, find what you can:

- When was it added? (Older = more likely consent has decayed) - What was the source? (Form? Trade show? Purchased? Imported from another tool?) - What's the engagement history? (Has this contact opened anything in the last 12-24 months?)

Sort the list into three rough tiers based on what you can determine:

Tier A: explicit consent records visible, recently engaged. These are the strongest contacts. They'll likely re-permission cleanly.

Tier B: consent records unclear, but engagement exists. Worth attempting re-permission.

Tier C: no consent records, no engagement, or both. These are the riskiest. Some senders skip re-permission entirely on Tier C and just suppress them outright. That's defensible.

The split is rough. You won't have perfect data. Make your best estimate.

Step 2. Plan the re-permission send

The re-permission campaign is a single, careful email sent to all of Tier A and Tier B (plus Tier C if you choose to attempt it). It's not a series. It's not a marketing campaign. It's a clear, brief note that does three things.

It introduces or reintroduces the brand. Acknowledge the change of ownership or the change of context. Be honest about why you're sending this email.

It states the offer clearly. "If you'd still like to hear from us, click here. If we don't hear from you, we'll stop sending."

It commits to honoring the silence. The non-responders get suppressed. The responders are kept.

The single email has to do the whole job. No follow-up sequence. No "did you forget to click?" reminder. The single ask is the test of consent. Anything more starts to feel like coercion, which is the opposite of what re-permission is for.

Step 3. Send timing and volume

Send the re-permission email through your normal sending infrastructure, but warm up gradually if the inherited list is much larger than your usual volume. A sudden 10x spike in volume looks like compromise to mailbox providers, regardless of whether the content is good.

If you're going from a 5,000-contact regular send to a 50,000-contact re-permission send, split it across three or four days. Send to the most-engaged tier first. Build the volume gradually so providers see the curve as legitimate ramp, not spike.

Set up Postmaster Tools and a blocklist monitor before you send. The first day of the re-permission campaign is when you'll see whether the list is healthier or sicker than you guessed. Watch the data.

Step 4. Set expectations on response rate

Most senders expect higher response rates than they get. The math:

For a list with mostly Tier A contacts (clear consent, engaged), expect 40-60% re-permission rate.

For a mixed list (Tier A + Tier B), expect 20-40% re-permission rate.

For a list that's mostly Tier B and Tier C (unclear consent, low engagement), expect 5-20% re-permission rate.

If you sent to 50,000 contacts and 10,000 click through to confirm, that's a 20% response rate, which is healthy for a list of unclear provenance. Don't be disappointed by what feels like loss. The 40,000 you suppressed weren't subscribers. They were addresses.

Step 5. Suppress, don't delete

Anyone who didn't respond to the re-permission email goes onto a permanent suppression list. They don't get deleted. They get kept on a do-not-send list, indefinitely, so that:

- If they re-subscribe through a website form, you have a record of the previous opt-out and you can verify the new opt-in is real. - If they file a CASL or GDPR complaint asking why they got an email, you have a clean record showing they were on a suppression list. - If they appear on a future inherited list that gets merged in, you have automatic suppression.

Suppression is permanent. It doesn't expire. The only way back onto an active list is through a fresh, explicit, documented opt-in.

Step 6. Treat the survivors as a fresh list

The 18,000 contacts (or however many) who confirmed are now your active list. Treat them as a fresh start.

Their first send after re-permission should be a welcome experience, even though many of them have been "subscribers" for years. They've just made a new decision. Honor it. Send a brief welcome that thanks them for sticking around, sets expectations on what they'll receive, and offers a preference center.

Open rates on the post-re-permission send are usually exceptional. The list is now exclusively people who actively chose to be there. Engagement rates can run 2-4x what they were on the inherited list before remediation.

What this all costs and what it earns

Re-permission costs you list size in the short term. The family in the story I opened with lost 32,000 contacts on paper. They balked when I told them the number.

What they kept was a list of 18,000 people who actively chose the new ownership. Those 18,000 produced higher revenue per send than the 50,000 had been producing. The deliverability stayed clean. The brand reputation in the trade grew, instead of being burned by the inherited list's consent debt.

Two years later, the list had grown back to 35,000 through legitimate organic acquisition. Every one of those new contacts arrived through clean consent, joined an honest welcome, and behaved like an actual subscriber. The brand never had a deliverability incident. Their domain reputation became one of the strongest in their category.

The inherited list wasn't an asset. The honest 18,000 was. Inherited lists are a starting point, not a finish line. Earn the consent you didn't get. Honor the silence of the ones who don't respond. Build forward from there.

- Grant