Introduction
As an industry, ecommerce is shifting from the spray-and-pray, acquisition-obsessed ethos of the past decade to a model that values efficiency, incrementality, and meaningful customer connections. First-party data has become the holy grail - what separates winners from losers in a world where owning your audience marks the difference between sustained growth and fleeting success.
But most brands are approaching first-party data collection backwards. They see marketing compliance as the enemy of growth: a set of restrictive rules that limit their ability to capture customer information. This misunderstanding is costing brands hundreds of millions in revenue. Not from pricing, shipping, or conversion optimization, but from a far more fundamental oversight: failing to capture marketing consent from paying customers.
After analyzing our first 100 A/B tests representing over 15 million checkout sessions, our data shows that brands who optimize consent collection within compliance constraints see dramatically higher marketing consent rates and revenue than those using generic approaches..
This report compiles that data, revealing how transforming a customer's status from "non-marketable" to "marketable" represents one of the most overlooked levers for increasing customer lifetime value in ecommerce.
Consent-first marketing isn't growth's enemy. It's the infrastructure that makes structured, privacy-first data collection possible. And structured, privacy-first data is what the next era of commerce will be built on.
"The ecommerce industry is at an inflection point. Brands can either view marketing compliance as a constraint on growth or recognize it as infrastructure for it. The brands that understand this shift early will own the next decade of ecommerce. This data proves you can build bigger, more valuable audiences by embracing and working within privacy frameworks instead of avoiding them."
Report Summary
Methodology and Terms
This report uses Dataships data from over 100 A/B tests conducted across diverse Shopify Plus merchants from January 2025 to August 2025. This data consists of checkout consent performance metrics across regions and verticals, collected from over 15 million live checkout sessions.
Definition of terms used in this report
Standard Shopify checkout consent configurations used by merchants before implementing Dataships.
Dataships' dynamic consent optimization tailored to regional consent requirements and tested against control configurations.
Customers who have provided valid consent to receive marketing communications under applicable regional privacy laws.
Customers who have not provided marketing consent or are suppressed due to previous opt-out requests or regulatory restrictions.
Customer Lifetime Value, calculated by multiplying retention rates over time against average order value to determine total customer worth.
Legal permission granted by customers to receive promotional communications via email and/or SMS.
The percentage of checkout completions that result in valid marketing consent, calculated as marketable customers divided by total transactions.
The total number of previously non-marketable customers who became marketable during the measurement period.
The additional customer lifetime value generated from converting non-marketable customers to marketable status through consent optimization.
Checkout consent boxes that are selected by default, requiring customers to actively opt-out rather than opt-in.
Checkout consent boxes that are unselected by default, requiring customers to actively opt-in to marketing communications.
Key Insights
Our analysis finds that regional privacy laws, the way they are interpreted, and the way consent is collected against those interpretations is the primary driver of checkout opt-in performance across global markets. When brands break from the status quo and optimize consent collection within compliance frameworks, they consistently outperform those using generic approaches, achieving dramatic improvements in both subscriber acquisition and customer lifetime value.
The data shows that transforming customers from "non-marketable" to "marketable" status represents a massive revenue opportunity that most merchants are leaving uncaptured. While baseline performance varies significantly by region due to suboptimal interpretations of privacy law, every market and vertical demonstrates substantial upside when nuanced, compliance-first strategies are properly implemented.
The findings challenge the conventional wisdom that privacy regulations limit growth, instead revealing how regulatory frameworks provide growth leverage for brands that understand how to work within them.
How leading brands are optimizing for privacy-first growth
The best-performing brands across our dataset share one common philosophy: they've stopped viewing privacy regulations as obstacles to growth and started treating them as forward-looking infrastructure. These merchants understand that checkout is the best available surface for engaged, profitable audience growth, and that consent is the foundation for enabling it.
Here are the core tenants of that philosophy:
“As a company, we need to have the balance of compliance and conversion. List growth is important, but quality list growth is more important. If I 3X a list but only grow revenue by 2%, that’s not a good story. The win is when list growth and revenue scale together.”
Incremental repeat purchase revenue from new subscribers
Checkout email opt-in rate
Checkout SMS opt-in rate
We moved from a basic Shopify opt-in at checkout to Dataships and it took our opt-in rate to nearly 100%. Now we can capture and retarget customers very compliantly. List growth is great, but it's not great if you get sued or land in spam; this gives us confidence to scale while following best practices."
Incremental repeat purchase revenue from new subscribers
New subscribers added monthly
Checkout SMS opt-in rate
Database growth was already part of our strategy, but Dataships helped us unlock the potential of database growth through checkout in a scalable way. Now we're capturing the audience we were always meant to have — and the revenue proves it.
Checkout SMS opt-in rate
Email opt-in rates by region
Most merchants and the technology providers that support them operate with surface-level understanding of global privacy regulations, creating industry consensus around consent collection that misses critical nuance. Consent collection at checkout gets built on generic interpretations of complex regional privacy laws rather than deeper understanding of what's actually permitted.
This leaves massive audience growth on the table while creating unnecessary compliance risk.
The consent collection mechanism you use determines your Marketing Consent Rate (MCR) more than any other factor, yet that mechanism gets chosen based on broad legal interpretations rather than nuanced optimization within regulatory frameworks. Whether you're using single or double opt-in compounds this effect, and often brands use overly conservative approaches that sacrifice list growth without meaningfully improving compliance.
The percentage of checkout completions that result in valid marketing consent, calculated as marketable customers divided by total transactions.
The data below shows the current industry 'status quo' for regional opt-in performance.
Where most brands are right now
The current MCR landscape reveals stark regional differences that directly reflect how brands interpret privacy laws and implement consent strategies against them.
Prevailing strategy:pre-ticked
Prevailing strategy: unticked
Prevailing strategy: unticked
Prevailing strategy: varies
North American brands achieve the highest baseline rates using pre-ticked consent boxes, which remain legally acceptable under CAN-SPAM and CASL. The 61% represents customers who simply don't uncheck the box during checkout. However, the pre-ticked approach actually collects more consent than legally required in the USA and Canada, leaving optimization potential on the table.
Note: SMS consent in the US follows different rules under TCPA, where current best practice is collecting double opt-in consent. See SMS section at end of report.
Pre-ticked boxes also carry hidden compliance risks, even in North America. Shopify can inadvertently re-subscribe suppressed contacts when syncing with ESPs like Klaviyo - turning opted-out customers into potential violations.
The dramatic drop to single digits reflects a consensus around how brands interpret Privacy Directive and GDPR's requirement for active consent. Most merchants present unticked boxes, requiring customers to deliberately choose marketing while focused on completing their purchase. This creates significant friction in the checkout process, with most customers ignoring the consent option entirely.
Continental Europe operates under the same GDPR framework as UK/Ireland, explaining the identical baseline performance. Historically stricter requirements in France, Germany and Austria have traditionally dragged performance even lower, though recent legal changes are beginning to align German practices with the rest of Europe.
Global stores typically show slightly higher baselines because they may be implementing Shopify's new region-specific consent feature rather than applying the most restrictive rules everywhere. However, even Shopify's region-level consent limits collection options to pre-ticked or unticked-and doesn't accommodate certain regional requirements like notice at collection (required in Australia, Singapore, and Hong Kong). Many global brands apply conservative approaches across all markets to simplify compliance, limiting their growth potential in more permissive regions.
These performance levels are representative of the current industry consensus, but they don't represent the ceiling of what's possible within legal constraints. The same regional frameworks that appear to limit growth actually contain optimization opportunities that most brands haven't discovered.
Below, we show what those same brands achieve when applying privacy-first consent optimization:
The same brands, using privacy-first consent optimization, achieve dramatically different results.
The improvements come from understanding what's legally optimal in each market rather than applying generic approaches globally, then building that on top of a sophisticated compliance infrastructure that makes it all possible.
These aren't just higher numbers. They represent more owned audience growth, reduced dependence on paid acquisition, and stronger foundation for the first-party data strategies that will define the next decade of commerce.
Pre-ticked
Unticked
Unticked
Varies
Brands move from pre-ticked boxes to implied consent strategies, eliminating the friction of consent boxes altogether while staying fully compliant. This approach leverages the more permissive frameworks of CAN-SPAM and CASL for maximum list growth without requiring explicit consent actions from customers.
Merchants replace unticked boxes with soft opt-in configurations that present as "tick this box to opt-out" of communications. This approach leverages legitimate interest legal frameworks under the ePrivacy Directive and GDPR (see UK ICO) while maintaining full compliance and dramatically reducing checkout friction.
Continental Europe operates under the same GDPR framework as UK/Ireland, explaining the identical baseline performance. Historically stricter requirements in France, Germany and Austria have traditionally dragged performance even lower, though recent legal changes are beginning to align German practices with the rest of Europe.
🇩🇪 Germany
As of July 2025, German courts have changed their interpretation of national privacy law, and double opt-in is no longer required for email marketing. Going forward, Germany can collect emails using the same single soft opt-in method used throughout the rest of Europe. This regulatory shift should bring Continental EU performance more in line with UK and Ireland benchmarks as the change takes effect across the market.
🇫🇷 France
France is currently the sole country amongst EU member states that cannot use the soft opt-in due to their specific implementation of the e-Privacy Directive into regulation. To remain compliant in France, explicit opt-in is required.
Global brands implement dynamic consent strategies that automatically adapt to each visito's regional requirements rather than applying one conservative standard everywhere.
🇦🇺 Australia, 🇳🇿 New Zealand, and 🇧🇷 Brazil
Our data is limited for stores primarily selling to Australia, New Zealand and Brazil. These markets operate under strict privacy laws requiring explicit opt-in, creating fairly rigid consent requirements that prevent stores from benefiting from Dataships' growth components in the same way as other regions. We're closely monitoring changes to privacy legislation in these markets to serve them as soon as regulatory frameworks allow.
The consent infrastructure that makes this possible
These regional optimizations may appear as straightforward checkbox variations, but each strategy relies on compliance infrastructure that ensures legal defensibility at scale. Implementing these approaches without proper backend systems creates exposure - from regulatory fines to class action litigation targeting consent collection practices.|
Every optimization strategy above requires sophisticated compliance infrastructure operating far beyond basic functionality:
This infrastructure operates invisibly to customers while ensuring every optimization strateg remains within legal boundaries. Without these backend systems, frontend optimization becomes either legally risky or practically impossible to scale across global operations.
Industry growth benchmarks
Summary
Customers who subscribe to marketing consistently deliver higher lifetime value across ever vertical in our dataset. This pattern holds whether you're selling consumables with high repeat rates or luxury items with infrequent purchases.
When we analyze retention curves, the difference is clear: marketing subscribers maintain stronger purchase patterns over time compared to non-subscribers. Across our entire dataset, subscribed customers average $106 in CLV while non-subscribers average $44 - a difference of $62 per opt-in secured.
CLV Comparison: Subscribed vs Not Subscribed by Vertical
These numbers vary dramatically by vertical due to different AOV and repurchase patterns. A furniture brand might see customers purchase twice yearly at $560 AOV, while a cosmetics brand drives monthly purchases at $60 AOV. Both create different CLV profiles, but both show meaningful subscriber premiums.
The data below breaks down CLV impact by vertical, revealing how business models affect the value of converting customers from "non-marketable" to "marketable" status. Regional concentration also influences baseline rates - verticals with lower starting opt-in rates typically have more UK/EU brands, while higher baselines indicate more US/Canada representation.
Apparel
Apparel is our largest vertical and spans diverse sub-categories with distinct purchasing dynamics - luxury brands command high AOV but see seasonal purchases, while activewear operates at lower price points but drives purchases every few months. Whatever the mechanics, marketing subscription consistently drives value with a 2.34X CLV multiplier that reflects fashion's reliance on repeat engagement.
Fashion thrives on newness, seasonality, and personal expression. With 2,349 new subscribers monthly generating $63K in incremental LTV, apparel brands see substantial returns from optimizing checkout consent. The category's combination of seasonal purchasing and brand loyalty makes marketing subscription essential for capturing customers' ongoing fashion journey.
"We needed a solution that would increase opt-in rates at checkout while guaranteeing GDPR compliance. Dataships gave us both - quality list growth and complete reassurance."
Incremental LTV added
New subscribers added
Marketing consent rate
Consumable & Wellness
High repeat purchase potential
Consumable & Wellness brands have extremely high repeat purchase potential, driving the highest CLV lift across all verticals - nearly 3X from non-subscribed to subscribed customers. When consumers try a new product, they're evaluating whether it earns a spot in their regular rotation, often becoming part of weekly or monthly routines for years.
The strategy unfolds in stages: convert one-time purchasers into repeat buyers, then transform repeat customers into subscription subscribers. With 2,381 new subscribers monthly generating $72K in incremental LTV, these brands see the strongest financial returns from securing marketing consent at checkout.
“Lasting growth comes from retention. Repeat customers, subscriptions, and loyalty are the real drivers. If we want to grow, it’s about getting more people opted into marketing."
Repeat purchase revenue from new subscribers
New subscribers every month
Marketing consent rate
Home & Living
Seasonal & project-based purchases
Home & Living brands operate across a spectrum where customers buying a $5,000 sofa may return for $30 throw pillows, or someone purchasing dinnerware returns seasonally for entertaining pieces. These purchases are part of larger home transformation journeys that unfold over months or years.
The $69 CLV difference reflects high-ticket anchors combined with ongoing smaller purchases. Home & Living achieves the strongest ROI at 39X, driven by lower contact frequency combined with high-value repeat purchases as customers' spaces evolve over time.
"When the results came in, it wasn't just that the list was growing — the leads were working. Seeing the data made it clear: Dataships was absolutely worth it."
Monthly repeat purchase revenue from new subscribers
CLV gain from each new subscriber
Marketing consent rate
Active, Recreation, & Hobby
Activity and interest driven
Recreation and hobby brands tap into passion-driven purchasing where customers actively seek products that enhance activities they love. Unlike necessity purchases, these feel-good buying decisions make marketing feel like helpful discovery, with subscribed customers delivering nearly double the value ($109 vs $56).
With 3,350 net new subscribers monthly, these brands unlock $27K in incremental LTV each month. Dog owners always need new toys, athletes continuously upgrade gear, and outdoor enthusiasts build their kit over seasons - making marketing essential for staying top-of-mind when purchase decisions arise.
“We moved from a basic Shopify opt-in at checkout to Dataships and it took our opt-in rate to nearly 100%. Now we can capture and retarget customers very compliantly. List growth is great, but it’s not great if you get sued or land in spam; this gives us confidence to scale while following best practices.”
Incremental repeat purchase revenue from new subscribers
New subscribers added monthly
Checkout email opt-in rate
High Value & Specialty
Considered purchases
High-value categories face unique retention challenges with customers making infrequent but substantial purchases, creating long gaps between transactions. Without marketing touchpoints, valuable customers often forget brands entirely or discover competitors when their next purchase occasion arises.
While this vertical shows the most modest financial impact with a $33 CLV difference, the strategic value is defensive positioning. When customers do return for their next high-value occasion, brands want to ensure they choose them over competitors who captured attention during dormant periods.
"We put compliance first, then optimize for growth. Without trust, there's no long-term brand value. Dataships gives us confidence that we can remain compliant on a continued basis."
Incremental repeat purchase revenue from new subscribers
New subscribers every month
Marketing consent rate
SMS Consent Collection
SMS Easy Opt-in is our newest product with compelling initial data. The findings are particularly exciting for brands eager to grow SMS lists compliantly in the US market, where SMS marketing faces fewer cultural barriers than in Europe, but conversely a stricter regulatory environment.
The standard approach by most platforms uses "Reply Y" - shoppers check a box at checkout, complete their purchase, then must find the brand's text message and reply "Y" to confirm. This disconnected, multi-step process delivers abysmal 0.6% average opt-in rates.
Easy Opt-in replaces this friction by presenting the double opt-in verification code directly at checkout, transforming 0.6% rates into 6.6% on average - a 10X improvement. Denver Modern, our top performer, achieved 12% SMS opt-in rates.
Current SMS growth tactics center on discount incentives in exchange for numbers. While effective for mid-funnel acquisition, incentive-free checkout capture consistently outperforms on engagement and long-term value.
As of August 2025, our SMS A/B testing is live, meaning brands can evaluate their own growth potential through Dataships while we gather more comprehensive performance data for future benchmark reports.
2025 Regulatory Updates
The growth metrics throughout this report exist because of regulatory requirements, not despite them. The 81% global opt-in rates, regional performance gaps, and vertical CLV differences all stem from one core capability: maximizing consent within legal boundaries that keep shifting.
Privacy laws create the playing field where growth happens. Understanding how these rules evolve explains why consent optimization requires ongoing adaptation rather than set-and-forget implementation. When compliance requirements change, optimal consent strategies change too. Brands that adapt quickly maintain competitive advantage.
The regulatory changes from January through August 2025 directly impact the strategies and results discussed throughout this report. Each shift creates new opportunities for brands that understand how to optimize within updated constraints.
Europe escalates enforcement
GDPR fines for illegal direct marketing jumped from £500K to £17.5 million or 4% of global revenue - whichever is higher. That 35X increase signals European regulators moving from warnings to serious financial consequences.
Texas targets SMS aggressively
SB140 now treats SMS and MMS as telemarketing, requiring business registration, $10K bonds, and fees. The law enables private lawsuits with substantial damages while strictly enforcing quiet hours and do-not-call compliance. Similar requirements have been proposed or implemented in Illinois, Oregon, Virginia and Florida, with more states expected to follow suit.
US phone rules create complexity
Federal courts eliminated "one-to-one" consent requirements, while new opt-out mandates launched April 11, 2025. SMS compliance grows more complex as federal and state regulations diverge. The recent SCOTUS decision in McLaughlin has shifted authority from the FCC to district courts and state authorities.
State privacy laws multiply
Seven additional states - Delaware, Nebraska, New Hampshire, wa, New Jersey, Minnesota, and Maryland - launched comprehensive privacy frameworks in 25. The total now stands at 19 states with distinct privacy rules, prompting Congress to call the patchwork "untenable."
California adds operational burden
New requirements around automated decision tools, risk assessments, and cybersecurity audits create additional compliance obligations for brands selling in the state.
International Developments
The UK ICO is adjusting its direct electronic marketing guidance in light of the Data Use and Access Bill, the EU is reviewing practices alongside the Al Act and upcoming Digital Fairness Act,, and new data portability rules launched in September. South Africa has reviewed its guidance under POPIA, Switzerland tightened cookie banner standards, and India released draft privacy guidelines. A recent Garante decision in Italy has highlighted the importance of robust audit logging and being able to clearly demonstrate consent.
The pattern is clear: privacy rules are getting stricter globally while penalties become severe enough to seriously damage businesses. The brands building compliance into their growth strategy from day one will have major advantages as this trend accelerates.
Closing thoughts
The checkout moment represents the highest-intent traffic your brand will ever see. Someone has browsed your products, added items to cart, entered payment information, and is seconds away from becoming a paying customer. Missing the marketing opt-in at this moment means losing your best opportunity to turn a transaction into a relationship.
Most brands overlook this lever because they fail to understand the leverage that gets created when a customer is providing you first-party data. Checkout becomes the make-or-break moment for both regulatory compliance and marketing permissions.
As commerce scales toward Al-driven automation, clean data becomes the competitive differentiator. The brands building consent-first data collection now create infrastructure for the next era of commerce - where data integrity determines who you can market to, who can leverage Al effectively, and who gets left behind.
Your consent infrastructure represents both opportunity and protection. The brands treating consent collection as a foundational strategy position themselves for long-term success as privacy requirements tighten and data quality becomes paramount.
Turn every checkout into a lasting
relationship
Dataships customers have unlocked over $600M in incremental revenue by converting checkout visitors into marketing subscribers. With an average CLV difference of $62 per opt-in, brands generated $65K in monthly incremental LTV while maintaining bulletproof compliance across every market.
Want to know how much revenue you're leaving on the table at checkout? Run a free A/B test with Dataships and get your actual CLV difference, opt-in rate potential, and monthly revenue projections - all while staying 100% compliant in every region you sell.
