Marketing Cloud Next Consent: Pardot Opt-Ins
How consent works in Marketing Cloud Next, why a contact without a record counts as opted out, and how to carry your Pardot opt-ins over safely.
Marketing Cloud Next stores consent per communication subscription and channel, on the email address or phone number, in Data 360 (formerly Data Cloud). A lead or contact without a consent record counts as opted out, and CRM consent isn't picked up by itself, so opt-ins from Account Engagement (Pardot) must be matched or imported before the first send.
- In Marketing Cloud Next every lead or contact without a consent record counts as opted out, so until consent is matched or imported nobody receives marketing email.
- Consent from Salesforce CRM and custom GDPR checkboxes isn't recognised; only consent records in Data 360, written in ways Salesforce supports, allow a send.
- Pardot email opt-ins can be matched automatically in two ways (one B2B Email Consent subscription, or up to 100 public lists as new subscriptions), from one business unit only.
- SMS and WhatsApp need their own consent per channel and come in by import or a new opt-in; email matching doesn't cover them.
- The legal responsibility stays with your company: Salesforce says double opt-in alone doesn't guarantee compliance, and deletions in Pardot don't reach Data 360 by themselves.
How Does Consent Work in Marketing Cloud Next?
Every promotional email and every SMS, WhatsApp or RCS message in Marketing Cloud Next (MCN) checks consent for one subscription on one channel. If the recipient hasn't opted in to that subscription on that channel, the message doesn't go out.
A communication subscription is a topic people opt in to, such as the newsletter or event invitations. MCN starts with one editable default subscription called Marketing.
The consent records live in Data 360, Salesforce's data layer under MCN, and belong to the address or number:
"Consent is tied to the contact point value, as opposed to the Unified Individual record itself."
Data 360 joins a person's leads and contacts into one profile, the unified individual, but consent sits on the email address. Salesforce's own example in its adoption plan is an email address. That's why Pardot consent is matched per email address, and why consent for one address says nothing about a second one.
Consent checks for transactional email are off by default. Deleting a subscription also deletes all of its consent data, so plan them before you collect consent.
Why Does a Contact Without a Consent Record Count as Opted Out?
Because MCN never assumes consent. Salesforce says MCN "treats any prospect, lead, or contact without a consent value as opted out by default", for every channel and subscription.
Until you match or import consent, your whole database is unreachable for marketing email. CRM consent records "aren't automatically recognized", and neither are fields on leads and contacts such as a custom GDPR checkbox. Salesforce's consent knowledge article: "there is no supported path to drive sends from custom flag fields".
Supported ways to write consent, per the same article, include CSV import, the Consent Status component, unsubscribe links, preference pages, forms with an event-triggered flow and the Create Consent action. Writing straight into the consent data objects is unsupported and can backfire: "an email may be sent inadvertently, even though the email address appears opted out."
How Is Consent in Pardot Different?
Pardot has two levels of consent, the Opted Out field and public lists. MCN has one: the subscription, per channel.
| Topic | Pardot | Marketing Cloud Next |
|---|---|---|
| Where consent lives | On the prospect: the Opted Out field for all email (it applies to every prospect with that address), public lists for single topics | On the email address or phone number, per subscription and channel, in Data 360 |
| No consent value | Mailable, unless Do Not Email, Opted Out or bounces stop it | Opted out |
| Overall opt-out | Opted Out means no marketing email at all | No overall field; "unsubscribe from all" opts out of each subscription |
| Unsubscribe link | Ends all marketing email | Ends only the subscription of that email |
| Do Not Email | Suppresses email; Salesforce says it "doesn't track consent" | Consent records decide; Do Not Email can still filter segments |
| Double opt-in | Confirmed opt-in with a form handler, an email and two dynamic lists | A flow with a transactional confirmation email and the Consent Request action |
| Consent date | No precise consent date like MCN's | Each record carries a date; older imported dates are ignored |
| Deleting a person | Prospect goes to the recycle bin | Consent stays in Data 360 until it is deleted there |
For the full product comparison, read Pardot vs Marketing Cloud.
How Do You Carry Pardot Opt-Ins Over to Marketing Cloud Next?
Either Pardot matches email consent automatically, or you import it as CSV files. Both follow one rule from Salesforce's knowledge article on moving consent: if a prospect is opted out in Pardot, "don't opt them into any subscriptions in Marketing Cloud Next."
Email Consent Matching: The Two Match Types
Email consent matching is switched on in the Pardot business unit, under Account Engagement Settings > Email Consent Matching. It needs Salesforce Enterprise or Unlimited Edition with Pardot Growth, Plus, Advanced or Premium, plus Data 360 or Marketing Cloud Next. Since Summer '26 there are two match types:
| Opted Out Field | Public List | |
|---|---|---|
| What it creates in MCN | One global email subscription called "B2B Email Consent", which you can rename | One new subscription per public list, up to 100 lists; you can't map a list to an existing subscription |
| A Pardot opt-out becomes | Opted out of B2B Email Consent, not Unsubscribe All | Unsubscribe All |
| An opt-in in MCN | Updates the Opted Out field in Pardot | Opts the person back in to the public list and to all email in Pardot, even after a global opt-out |
| Condition | Sync behaviour of the Opted Out field: most recently updated value, Account Engagement's value, or unmapped | Fewer than 250,000 active, opted-out prospects in the business unit |
| Our recommendation | Choose it if you have no public lists; Salesforce advises it only then | Choose it if your preference center already splits topics into public lists |
With both types, consent updates flow in both directions. Pardot resyncs a prospect whenever it is created, gets a new email address, is added to a list or is restored from the recycle bin. Matching links one business unit only: "Multiple business units aren't supported."
Updates can take up to 48 hours to process; don't import new consent records until matching is done. Do Not Email isn't consent, and moving a prospect to the recycle bin doesn't change their consent in MCN. To restart matching later, first delete or rename the MCN subscription it created.
Older Salesforce pages, such as the Key Concepts page, still say consent isn't shared between the apps; the consent matching page is newer. Don't expect matching to sync more than the Opted Out field or the public lists you map.
Consent Import
For other channels, or when matching doesn't fit, you import. One CSV file covers one subscription, one channel and one consent status. Column one holds the email address or the phone number with country code, column two the consent date. A file takes up to 50,000 rows. Our CSV splitter cuts a longer list into files of that size, each with the header row.
An import from the Consent tab creates no leads or contacts; to create them with consent, import from the Leads or Contacts tab. If a record already has a newer date, the older date in the file is ignored.
Which date you import is your call. Salesforce's knowledge article recommends the Publication Opt-In Date/Time; a Help page gives the Last Updated date as an example. Agree it with your data protection officer before the first file.
Four Traps Salesforce Documents
- When you export Pardot preference lists and import them by hand, a prospect who is opted in to email but to no list, or opted out of all email but opted in to a list, ends up opted in to no imported subscription.
- A prospect created in Pardot (form, import, API or by hand) brings its Pardot status, which "overrides any existing consent history" in both apps. Prospects created by the Salesforce connector follow the sync rules instead.
- When a known person submits a new lead capture form, Data 360 overwrites their consent status to opted out. Salesforce's setup guide says to "include an explicit Opt In checkbox in every lead capture form".
- Marketing to the same people from both systems at once. Salesforce advises a pilot group or a single subscription first.
Where consent sits among the other setup steps is in our guide to what moves from Pardot to Marketing Cloud Next.
What This Means for Sales
Sales sees the same leads and contacts as before, but whether marketing may email them now depends on the consent record. The Consent Status component on the record is a supported way to record consent, so agree with sales who may use it and when.
How Does Double Opt-In Work in Marketing Cloud Next?
In Marketing Cloud Next, double opt-in is a flow you build. Salesforce describes the steps: a form submission starts an event-triggered flow, a transactional email asks for confirmation, Wait Until Event watches the confirmation link, and the Consent Request action records the opt-in.
The confirmation email has to be marked as transactional: "Only emails marked as Transactional can be sent to contacts without confirmed consent." The consent actions work in event-triggered, on-demand and Data 360-triggered flows; audience flows don't offer them. Salesforce adds: "Double opt-in alone does not guarantee full regulatory compliance." Our GDPR package for double opt-in and consent builds and tests it in Pardot or Marketing Cloud Next.
How Do the Preference Center and Unsubscribe Work?
MCN has preference pages per channel, with one default page per channel. If you enabled MCN after April 2026, custom preference pages are on from the start; before that, you turn them on.
- The unsubscribe link in an email ends only the subscription of that email, at once. Add the Preference Manager link for everything else; that merge field doesn't work with custom preference pages.
- "Unsubscribe from all" on a preference page sets every subscription the person belongs to to opted out.
- Salesforce tells you to add an opt-out link and a physical mailing address to promotional emails, naming the U.S. CAN-SPAM Act. The address comes from Company Information in Setup.
How Does Consent Work for SMS and WhatsApp?
Each channel needs its own consent, and consent matching covers email only, so SMS and WhatsApp consent come in by import, forms or the channel's own opt-in.
For SMS, STOP, QUIT, CANCEL, END and UNSUBSCRIBE are reserved words: "Salesforce immediately unsubscribes the recipient from all messages from that sender code." Alphanumeric sender IDs can't receive opt-outs. SMS opt-ins and opt-outs apply per sender code, and consent on one channel has no effect on another. For WhatsApp, you set the consent type per number to Explicit Opt-In; Salesforce's Trailhead adds that Meta requires an opt-in that names your business and WhatsApp.
What Does GDPR Mean for Consent in Marketing Cloud Next?
MCN gives you the tools; the legal responsibility stays with you. Salesforce writes: "You're responsible for complying with any laws or regulations that apply to your business."
Salesforce names GDPR and Canada's CASL as strict about implicit consent and advises a legal review before relying on it. Switching consent checks off requires you to "affirm responsibility for any compliance-related issues that arise".
Deleting a prospect in Pardot doesn't delete the person in MCN or Data 360, so someone with Data 360 rights has to delete them there as well; Data 360 reprocesses deletion requests after 30, 60 and 90 days. Consent history sits in the Consent Audit Trail data lake object.
Website tracking has its own consent: MCN uses Salesforce's consent banner, and Salesforce doesn't support third-party consent platforms such as OneTrust. If you require consent to track, the first page view isn't recorded. The sfmc_consent cookie (365 days) is set to False, and tracking stops, when a visitor opts out or ignores the banner. For tracking consent in Pardot, our eBook on Pardot cookies and GDPR walks through the setup.
Your Options
Stay. You send from Pardot only. Doing nothing is a valid outcome; our Pardot consulting checks opt-ins, preference center and unsubscribe page where they are.
Add. You start sending from MCN next to Pardot. Pick a match type, run a pilot on one subscription, then extend. With Marketing Cloud Next consulting you get subscriptions, matching and imports set up before your first send.
Move. Most sending moves to MCN. Consent comes first in the project plan, before forms and flows. The one-pager "Consent in Marketing Cloud Next: Bring Your Opt-Ins" is free on our eBooks and one-pagers page.
Frequently Asked Questions
Does Pardot Consent Carry Over to Marketing Cloud Next Automatically?
Only if you switch on email consent matching or import it. Without either, MCN treats every lead and contact as opted out. Matching covers email; other channels need an import or a new opt-in.
What Is the B2B Email Consent Subscription?
It's the single global email subscription that consent matching creates when you choose the Opted Out Field match type. A Pardot opt-out sets it to opted out but doesn't unsubscribe the person from other MCN subscriptions. You can rename it.
Can a Custom GDPR Checkbox on the Lead Control Who Gets Email?
No. Salesforce says there is no supported path to drive sends from custom flag fields; sends check the consent records in Data 360.
Does Unsubscribing in Marketing Cloud Next Stop All Emails?
The unsubscribe link stops only the subscription of that email. "Unsubscribe from all" on the preference page opts the person out of every subscription they belong to.
