PDPA Consent Capture During 9.9: Building a Legal Remarketing List Before 11.11

Here is the short answer: you may only remarket to your 9.9 buyers if they gave clear, specific, unambiguous consent at the moment you collected their details — and for Singapore mobile numbers you also need to handle Do Not Call obligations. An order record is not consent. A marketplace payout report is not consent. If the consent checkbox and the wording next to it are not live on your checkout before 9 September, you will finish the sale with several thousand orders and a contact list you cannot legally use for 11.11. That is a two-day fix, not a two-month one, and it is worth doing this week.

Why does consent have to be decided before the sale, not after?

Consent under Singapore's Personal Data Protection Act is tied to notification: the customer has to be told what you will use their data for, at or before the point you collect it. You cannot reconstruct that afterwards. Emailing your 9.9 buyers in October to ask whether they would like to receive marketing is itself a marketing message to people who never agreed to receive one.

This is the single most expensive omission we see in post-peak reviews. An SME does S$180,000 in 9.9 revenue across 2,400 orders, then discovers in late October that its entire acquisition list is transactional-only. The 11.11 campaign gets built on paid traffic instead of owned audience, and the effective cost per order roughly doubles. The sale worked. The data flow did not.

What does a compliant consent capture point actually look like?

Operationally, four things need to be true at the checkout or order-confirmation step:

• It is separate from the purchase. The customer must be able to buy without agreeing to marketing. Bundling consent into your terms and conditions does not hold up.
• It is unticked by default. Pre-ticked boxes are not affirmative consent. This is the most common technical default to override in Shopify, WooCommerce and most Singapore payment plugins.
• The purpose is stated in plain language. "Send me promotions, new product launches and sale alerts by email and WhatsApp" is usable. "I agree to receive communications" is not — it does not name the channels or the purpose.
• The consent is stored as data, not as a screenshot. You need the timestamp, the exact wording shown, the channel consented to, and the source. If you are ever asked to evidence consent, "we had a checkbox" is not an answer; a database field with a date is.

That last point is where most implementations quietly fail. The checkbox exists, the customer ticks it, and the value is never written anywhere durable — or it is written to a field your email platform never reads.

What can you actually use from Shopee, Lazada and TikTok Shop data?

Very little, and this catches people out. Marketplace order exports typically give you masked contact details, a platform-issued buyer ID, and a delivery address routed through the platform's logistics partner. You do not receive a customer's real email address or mobile number with consent attached, and the platform's own terms restrict using order data to contact buyers off-platform.

The practical consequence: marketplace channels grow revenue but not your owned audience. If 70% of your 9.9 volume comes through marketplaces, then 70% of your peak-season customers are not yours to remarket to. The workaround is not to scrape the export. It is to give buyers a genuine reason to opt in through a channel you control — a warranty registration, an extended-returns window, a product care guide, a QR code on the packing slip that leads to a first-party form with proper consent wording. Insert-card conversion rates of 8-15% are realistic. On 2,400 orders that is 200-350 contacts you legitimately own, which is a materially better position than zero.

How do you separate transactional messages from marketing messages?

This distinction governs your entire post-9.9 communications flow, and it is worth making structural rather than judgemental.

Transactional messages fulfil the order the customer already placed: order confirmation, payment receipt, dispatch notice, tracking link, delivery attempt, RMA status. These are necessary to complete the transaction and do not depend on marketing consent.

Marketing messages promote something new: 10.10 previews, restock alerts, abandoned-cart nudges, cross-sell recommendations, festive campaigns. These require consent — and where you are sending to a Singapore mobile number, Do Not Call obligations apply unless you have clear and unambiguous consent on file or fall within a recognised exemption.

The failure mode is the hybrid message: a delivery update with a discount code appended. That is a marketing message wearing a tracking number. Build two separate WhatsApp Business template sets and two separate sending lists, and route them from different fields in your database. If your operations team has to decide message by message which category something falls into, the rule will not survive a busy Friday.

What does the data flow look like end to end?

The workflow you want running by 9 September evening:

• Checkout captures marketing_consent, consent_timestamp, consent_text_version and consent_channel alongside the order.
• Every order — consented or not — flows into your order system and triggers transactional WhatsApp and email notifications.
• Only consented records sync into the marketing list, with source and date tagged so you can segment "9.9 2026 buyers" later.
• Singapore mobile numbers destined for marketing are screened against the Do Not Call Registry before any campaign send, with the screening date logged.
• Every marketing message carries a working unsubscribe path, and withdrawals write back to the order system within your stated timeframe — not just to the email tool.

That last write-back is the step most SMEs skip. Someone unsubscribes from email, but the number stays live in the WhatsApp broadcast list, and they get a 11.11 blast anyway. One source of truth for consent status, with the marketing tools reading from it, prevents the complaint that follows.

What should you do in the two days before 9.9?

Realistically, three things. First, get the checkbox and its wording live on your own storefront and any first-party landing pages, unticked, with the four consent fields written to the database. Second, print or generate the packing-slip QR insert for marketplace orders so that channel is not a total loss. Third, split your WhatsApp templates into transactional and marketing sets now, while nobody is under pressure.

Everything else — list hygiene, segmentation, the 10.10 and 11.11 campaign build — can wait until the week after the sale. Consent cannot. It is the one part of your peak-season data infrastructure that has an expiry date of 9 September.

This is workflow design, not legal advice. If your data practices are complex or you handle sensitive categories of personal data, have your consent wording reviewed by a qualified adviser before you deploy it.

Frequently asked questions

Can I message 9.9 buyers about their order if they did not tick the marketing box?

Yes. Order confirmations, dispatch notices, tracking links and return status updates are transactional communications that fulfil the purchase the customer already made. What you cannot do is attach a promotion, discount code or campaign teaser to those messages, because that converts them into marketing content sent without consent.

Does the Do Not Call Registry apply to WhatsApp messages?

DNC obligations cover specified marketing messages sent to Singapore telephone numbers, and messaging apps tied to a mobile number are generally treated within scope. The practical approach is to screen Singapore numbers before marketing sends unless you hold clear and unambiguous consent, log the screening date, and keep transactional messages on a separate template set so they are never caught by the same rule.

We already have 5,000 contacts from previous sales with no consent record. What now?

Do not assume they are usable and do not mass-email them asking for consent. Segment the list by what you can actually evidence: contacts who bought from your own storefront while a compliant checkbox was live, contacts where you have documented opt-in, and everyone else. Use the evidenced segments for 11.11, and rebuild the rest through fresh first-party capture from 9.9 onwards. A smaller list you can defend is worth more than a large one you cannot.