---
title: "Keep a suppression entry when you erase a · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/email-privacy/suppression-after-erasure
updated: 2026-10-21
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Keep a suppression entry when you erase a contact

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Email privacy](https://agentwranglers.se/playbook/email/email-privacy.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers). Updated 2026-10-21.

- ID: EML-72
- Level: Required
- Chapter: [Email privacy](https://agentwranglers.se/playbook/email/email-privacy)
- Rule: When a contact unsubscribes, objects or asks for erasure, keep only a hashed address, the list and the date on a suppression list. Check every send and import against it.
- Risk: A law broken
- Applies when: The project sends email.
- How: An objection to direct marketing is absolute (GDPR Article 21(3)). Deleting the address alone lets a later import or sign-up sync add it back. So erase the profile, but keep a minimal suppression row. Hash the trimmed, lowercased address with SHA-256 and store nothing else about the person. Mark the row as kept to honour the objection, never for marketing. Filter every send job and list import against it, next to [unsubscribes](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/honour-unsubscribes) and [consent records](https://agentwranglers.se/playbook/email/email-privacy/consent-records). Remove the row only when the person signs up afresh. Run the same step when someone deletes their account, as in [let people delete their account themselves](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/account-deletion).
- Check: Erase a test contact, then import a list that holds the same address in another case. The import skips it, and a send to the list does not reach it. The suppression row holds only the hash, the list and the date.

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
import { createHash } from 'node:crypto';

const suppressionKey = address =>
  createHash('sha256').update(address.trim().toLowerCase()).digest('hex');

function withoutSuppressed(addresses, suppressedKeys) {
  return addresses.filter(address => !suppressedKeys.has(suppressionKey(address)));
}
```

### Python example

```python
import hashlib

def suppression_key(address: str) -> str:
    return hashlib.sha256(address.strip().lower().encode()).hexdigest()

def without_suppressed(addresses: list[str], suppressed_keys: set[str]) -> list[str]:
    return [a for a in addresses if suppression_key(a) not in suppressed_keys]
```

## Sources

- [GDPR Article 21, Right to object](https://eur-lex.europa.eu/eli/reg/2016/679/oj)
- [ICO, Respect people's preferences](https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/direct-marketing-guidance/respect-peoples-preferences/)

## Related rules

- [Unsubscribe within two days](https://agentwranglers.se/playbook/email/unsubscribe-and-bounces/honour-unsubscribes) in Email
- [Keep proof of consent](https://agentwranglers.se/playbook/email/email-privacy/consent-records) in Email
- [Let people delete their account themselves](https://agentwranglers.se/playbook/accounts/profile-and-account-lifecycle/account-deletion) in Accounts

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/email/email-privacy/suppression-after-erasure">Agent Wranglers email playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep proof of consent](https://agentwranglers.se/playbook/email/email-privacy/consent-records)
- Next: [Keep email logs lean](https://agentwranglers.se/playbook/email/email-privacy/lean-email-logs)
- [Email privacy](https://agentwranglers.se/playbook/email/email-privacy)