The entry is not the consent
Buyers routinely conflate two different events. The entry is the consumer submitting details to be considered for a prize. The opt-in is the consumer separately agreeing that named advertisers, or a described category of advertisers, may contact them about offers. A sweepstakes can generate the first without the second, and a file built only on entries is not a marketable lead file no matter how recent it is.
This is why the disclosure language matters more than the entry form design. The language defines the scope of what you bought: which channels are permitted, who is permitted to contact the consumer, and for what purpose. If a supplier cannot show you the exact wording a consumer saw, they are selling you an entry, and you are absorbing the risk of assuming it was an opt-in.
What a complete consent record contains
A usable consent artefact has five components. First, the verbatim disclosure text as displayed, not a summary of it. Second, a timestamp precise to the minute, in a stated time zone. Third, the source — a campaign identifier and, for online entries, the URL of the page where consent was captured. Fourth, a capture context: IP address for web entries, the physical card image or transcription reference for mail-in entries, the call reference for telephone opt-ins. Fifth, the channels the consumer agreed to, held separately rather than merged into a single flag.
That last point catches more buyers than any other. Email consent, call consent and SMS consent are distinct permissions with distinct rules, and a file that reports one boolean 'opted in' column has flattened information you need. Ask for them as separate fields. If a supplier cannot produce them separately, assume the narrowest interpretation and plan your campaign accordingly.
Freshness is a consent question, not just a performance one
Most buyers think of lead age purely in terms of response rate — a fair instinct, since contact rates fall sharply after the first days. But age also erodes the reasonableness of the consent itself. A consumer who agreed twelve months ago to hear about partner offers has, in practical terms, forgotten the interaction, and a call referencing it lands as a cold call regardless of what the record says.
This is the argument for tight refresh cycles rather than large archives. A file rebuilt every few days keeps the consent recent enough that the consumer recognises the context when you make contact, which is simultaneously the compliant position and the profitable one. Those two things align far more often than the industry's reputation suggests.
How to audit a supplier in one email
You can separate serious suppliers from list flippers with a short list of requests, before any money moves. Ask for a ten-record sample with the full field structure, including every consent field. Ask for the verbatim disclosure text for the specific segment you are buying. Ask how old the oldest record in the file is, and how the file is refreshed. Ask what suppression is applied — do-not-call, litigator, complainant history, disconnects — and whether it is applied per delivery or once at build time.
The answers matter less than the shape of the reply. A supplier who can answer all five specifically, in writing, in one pass, has systems behind the file. A supplier who answers with volume claims and pricing is quoting from a spreadsheet someone sold them.