Marketing suppression lists

Detects marketing suppression / do-not-contact lists: a suppression list / do-not-contact / opt-out list phrase combined with populated contact data - email addresses, Australian phone numbers or labelled opt-out/suppression dates and reasons. Phrase-only mentions (Spam Act guidance, unsubscribe policies) stay discovery-only.

Type: regex
Engine: boost_regex
Confidence: medium
Confidence justification: Enforce tiers require populated contact data (email, phone, labelled opt-out/suppression values) beside the suppression-list phrase; Spam Act guidance and unsubscribe policies stay at 65, as do header-only upload files. 'Spam Act', 'direct marketing' and 'Do Not Call Register' moved from the primary to 85 evidence. Medium because marketing send lists near the phrase can also carry emails.
Detection quality: Topic false positive
Jurisdictions: global
Regulations: Spam Act 2003 (Cth), Do Not Call Register Act 2006 (Cth), Privacy Act 1988 (Cth), Information Privacy Act 2009 (Qld), NDB Scheme (Cth), GDPR
Frameworks: ISO 27001, ISO 27701
Data categories: pii
Scope: wide
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Compatible, Macie: Compatible, Zscaler: Compatible, Palo Alto: Degraded, Netskope: Unsupported

Pattern

(?i)\b(?:(?:marketing\s+)?suppression\s+lists?|do[\s-]+not[\s-]+(?:contact|mail|call|email)\s+(?:lists?|flags?)|marketing\s+exclusion\s+lists?|(?:email|sms)\s+suppressions?|opt[\s-]?out\s+lists?|unsubscribe\s+lists?)\b

Corroborative evidence keywords

Spam Act, Do Not Call Register, hard bounce, spam complaint, withdrawn consent, unsubscribe, opt-out, deceased, vulnerable customer, do not market, data record, database record, record set, data extract, data export, database table, spreadsheet, data registry, registry entry, master data (+2 more)

Proximity: 300 characters

Should match

Marketing suppression list - export 12/09/2026 email,mobile,suppression_reason,opt_out_date avery.teston@mailbox.com.au,0412 345 678,unsubscribe,2026-08-02 jordan.w@harbourmail.net,0423 555 019,deceased,2026-08-15 Do Not Call Register wash completed; hard bounce addresses added. — Suppression export - header, emails, phones and suppression evidence (85)
Do not contact list addition Opt-out date: 12/09/2026 Requested through the app. — Single labelled opt-out date (75)
CRM contact note - do not call flag applied Customer: R. Pemberton-Lau Mobile: 0491 570 156 Suppression reason: Withdrawn consent by phone Suppression date: 14/10/2026 Also marked do not market across email and SMS; Do Not Call Register check logged. — CRM do-not-call flag with mobile number and labelled suppression reason and date plus withdrawn-consent evidence (85)
Do not call flag applied Mobile: 0491 570 156 Customer reported withdrawn consent by phone; do not market. — Single labelled mobile number plus withdrawn-consent evidence - one structure, so 75 not 85 (a labelled field is not a column header)

Should not match

Policy guidance: add every unsubscribe request to the suppression list within 5 business days, as the Spam Act requires, and wash call lists against the Do Not Call Register. — Compliance guidance
Suppression list upload email,mobile,suppression_reason,opt_out_date — Blank upload file - column header only (65)
The retailer was fined after emailing people on its suppression list, the regulator said in a media release. — Media release
unrelated generic text without domain phrases — Unrelated
customer invoice — Generic word pair

Known false positives

Privacy notices, help-centre articles, product pages and policies describing marketing suppression. Mitigation: They name the topic without populated rows, labelled values or identifiers, and guidance/help framing is excluded, so they stay at 65.
Analytics training material and documentation with worked examples of marketing suppression. Mitigation: Training and template framing is excluded; unframed worked examples with realistic rows can still reach 75.
News and industry commentary with aggregate statistics. Mitigation: Aggregate percentages are not keyed to a record identifier, so they do not satisfy the row or labelled-value structures.