Does an autoreply with a new email address count as consent to contact new email?

[MSytsma]

We've received an autoreply email saying that a contact has left their current company, and in the autoreply, they've included a new email address at which they can be contacted. I'm wondering if this "counts" as consent to contact them at this new email address?

[JessicaBaskey · Accepted solution]

Hi @MSytsma,

I think an auto-reply with a new email address doesn’t count as permission to reach out.

Even if someone lists a new contact in their out-of-office, they haven’t actually opted in to hear from you at that address. HubSpot’s GDPR tools are built around getting clear, intentional consent—and this doesn’t qualify.

If you want to reconnect, you could send a friendly one-time message asking if they'd like to stay in touch, with a clear opt-in link. That keeps you compliant and respectful of their inbox.

Best,

Jess

[karstenkoehler · Accepted solution]

Hi @MSytsma,

Generally, if you want 100% confidence that you're doing the right thing, I'd recommend discussing this with your legal team and/or data privacy officer or, if you're in a small company without those, consult an external legal professional. Legislation varies from country to country, depending on your products, services, target group.

For most scenarios, I'm fairly certain that an autoreply does not constitute consent as consent cannot be given on behalf of someone else. Consent must typically be granted by the affected individual themselves.

There might be exceptions here depending on your relationship – such as a legitimate interest due to a customer relationship for example. This is what you should discuss with someone who has a legal background and can look at this in detail.

(My reply does not constitute legal advice.)

Best regards

[JessicaBaskey · Accepted solution]

Hi @MSytsma,

I think an auto-reply with a new email address doesn’t count as permission to reach out.

Even if someone lists a new contact in their out-of-office, they haven’t actually opted in to hear from you at that address. HubSpot’s GDPR tools are built around getting clear, intentional consent—and this doesn’t qualify.

If you want to reconnect, you could send a friendly one-time message asking if they'd like to stay in touch, with a clear opt-in link. That keeps you compliant and respectful of their inbox.

Best,

Jess