Consent for Ad Retargeting: What Your QR Lead Capture Screen Must Say Before Meta Sync

A lead who agreed to receive marketing emails hasn't automatically agreed to have their phone number or email hashed and uploaded to a Facebook Custom Audience — those are two different uses of the same contact, and treating one grant as covering the other fails on two fronts at once. DPDP's purpose-limitation principle requires that personal data be used only for the purpose it was actually collected for, and Meta's own Custom Audience Terms require that data used to build a Custom Audience come with a lawful basis specific to that use. SMLLR's Lead Capture Gate handles this by tracking ad targeting as its own distinct consent purpose in Lead Hub, separate from email and WhatsApp consent, so a lead granting one doesn't silently unlock the others.

SMLLR's marketing-consent checkbox on every Lead Capture Gate carries fixed, non-editable text — the same wording on every account, precisely because consistent, specific wording is what makes the consent demonstrable rather than ambiguous: "I agree to receive WhatsApp messages, emails, and personalized ads from this business based on my activity." That single sentence names all three purposes explicitly — WhatsApp, email, and personalized ads — rather than a vague "send me updates" a regulator or Meta could later argue didn't clearly cover ad targeting. The checkbox sits unchecked by default beneath the mandatory contact field, and checking it is never required to unlock whatever the QR code was gating — the contact field itself is the functional requirement; this checkbox is the separate, optional marketing grant.

Even though scanners see one checkbox, checking it records three separate consent purposes behind the scenes — one for WhatsApp, one for email, and one for ad targeting — each independently revocable and independently checked by the feature that uses it. A lead who later unsubscribes from an email campaign only revokes the email-marketing grant; their ad-targeting consent stays intact unless they separately withdraw it, and vice versa. Email Marketing checks the email grant before including anyone in a send, and Meta Sync checks the ad-targeting grant before including anyone in a Custom Audience sync — neither feature can accidentally reach someone who only consented to the other.

A withdrawal is recorded as a new consent entry that supersedes the earlier grant, not a silent edit or deletion of the original record — preserving an accurate history of what was actually agreed to and when. For ad targeting specifically, the very next Meta Sync run detects that the lead is no longer eligible and actively removes them from the Custom Audience, rather than simply excluding them from future adds. If a lead requests full erasure under DPDP, that erasure cascades further still — it removes them from the Meta Custom Audience too, not just from SMLLR's own database, since a synced audience entry is derived personal data that has to be honoured by the same erasure request.

A business bringing in an existing spreadsheet of contacts through CSV import can attest that genuine, pre-existing consent already exists for that batch — timestamped and IP-logged on the business's own liability — rather than the import defaulting to zero consent for contacts the business may already have had legitimate permission to contact. That attestation still has to specifically cover ad targeting if you intend to Meta Sync that batch; a CSV attested only for email use doesn't retroactively grant ad-targeting eligibility.

As of 2026, the DPDP Act's consent-manager registration opens in November, with the Act's core provisions — consent, privacy notices, and security requirements — becoming fully effective in May 2027. Building a purpose-specific, demonstrable consent flow now, rather than a vague blanket opt-in retrofitted later, is the cheaper path once enforcement is live. See the full DPDP-compliant lead capture guide for how this plays out across email and WhatsApp too, not just ad targeting.

Since the consent checkbox itself is fixed and can't be reworded per business, the only real lever a business has is the gate's title and framing — a benefit-led title ("Unlock 10% off" or "Join our list for early access") that gets more scanners to actually check the box, versus a bare "enter your details" that leaves the box unchecked more often. There's nothing to configure on the ad-targeting side specifically beyond turning on the Lead Capture Gate and connecting Meta Sync — consent tracking and enforcement happen automatically underneath both.