When it comes to consent, the United States is stuck in a gray area that most of the world left behind years ago.

In Europe and Canada, consent for communication and data use must be clear, informed, and freely given. Silence isn’t consent. Pre-checked boxes don’t count. And “we told you in the privacy policy” doesn’t fly.

But here in the U.S.?
We still operate in a system where “no means no” -- but everything else means yes.”

That might still be legal in many states.
But it’s not ethical.
And it’s not where the world is going.

Mission Meets Reality

As nonprofits, we’re not just in the business of delivering services or raising funds. We’re in the business of trust -- and that trust is built on how we treat people, including how we handle their data.

When we assume consent just because someone didn’t uncheck a box, or gloss over language buried in a footer, we’re not operating with the same care and intention we bring to every other aspect of our work.

We’re also missing an opportunity to lead.

I often coach nonprofits on how to define their values statements around consent, because it’s not just a policy question. It’s an expression of how we respect the people we serve and invite them into relationship with us. Consent management is values-based infrastructure.

The World Is Already Moving

• Under GDPR, consent must be “freely given, specific, informed, and unambiguous.”

• Canada’s Anti-Spam Law (CASL) requires express consent for marketing communications.

• In the U.S., 21 states now have privacy laws on the books, many of which are starting to require opt-in consent for sensitive data. However, other personal information is largely still collected on an "unless you told us no" basis.

This shift isn’t abstract. It’s visible in donor behavior. People are more aware of how their data is used and quicker to disengage when they feel over-targeted, under-informed, or disrespected.

We’re entering an era where “doing what’s technically allowed” is not the same as doing what’s right -- and it's certainly not what’s sustainable.

Why Haven’t We Caught Up Yet?

We know resources are tight. We rely on legacy systems. We don’t want to disrupt pipelines that are already under pressure.

But inertia isn’t a strategy.
And compliance isn’t the ceiling -- it’s the floor.

A Better Way Forward

This doesn’t require a full-system overhaul tomorrow. But it does require intention — and a commitment to asking better questions:

• Are we assuming consent unless explicitly denied?

• Are our opt-ins clear, easy to understand, and truly optional?

• Have we defined what consent means to us — not just legally, but ethically?

And most importantly:
Are our practices aligned with the respect we say we have for the people we serve?

Be the Organization That Leads

Our sector is often the first to stand up for equity, dignity, and agency. Consent is part of that story — and an area where we can lead by example rather than wait to be told what to do.

Because “no means no” should not be the bar.
Real trust starts when “yes” means yes -- and we actually take the time to ask for it.

--

If you're ready to help your team embrace consent-based operations, let's talk.