Stress-test an email preference center by proving that each customer choice can suppress the right channels inside the planned window, survive multi-ESP setups, and avoid trapping operators inside a green consent UI that hides stale lists.
Preference centers often list toggles while leaving sync latency, legal bases, and abort authority implicit. Those edges decide whether a late unsubscribe stops inside the window or leaves mail flowing under load. The exercise should follow actual systems, identity keys, and on-call paths rather than a clean privacy slide.
Inventory the preference path
List every channel and ESP with its preference schema, sync job, owners, and notification channels. Mark choices that cannot reverse without a central suppress table. Attach the last three preference incidents with raw timelines and any waivers. Include the source of truth for suppression counts during the observation window.
Define the phases for change, sync, observe, abort, and communicate. Each phase needs an owner and an exit condition. Write the point after which a stuck preference would require a different procedure, then review whether that action is still permitted. Capture maximum acceptable sync lag in measurable units, including which cohorts are excluded from self-serve and why.
Include the calendar of known events for the next two quarters: ESP migrations, legal policy updates, and campaign peaks that shrink the usable change window. A preference budget that ignores those dates will look calm until the week they land.
Failure drills
- A minority ESP ignores a global unsubscribe while the aggregate preference dashboard stays green.
- A preference change has already left a transactional-looking promo on a money path.
- The primary sync job lags beyond the planned observation window.
- An operator re-adds a segment because a partner deadline is close.
- SMS and email preferences collide under a shared identity key.
- Pause authority is unclear at 2 a.m. and the page lands on the wrong rotation.
For each drill, identify detection time, customer impact, containment, and the authority to halt sends. Require commands and dashboard links in the runbook. A statement that monitoring will catch it does not establish which alert fires or who receives it.
Prove preferences are synced and owned
Run the package in Pingpong with lifecycle, legal, support, and data seats. Ask legal which promise becomes unsafe first if suppressions stay local. Ask support whether agents can honor the same toggles on the phone. Ask lifecycle to show the exact suppress query used as the exit condition.
Related reviews include the lifecycle marketer seat, a winback campaign review, and a churn survey rewrite. Browse the war-game decisions hub for adjacent controls.
Authorize the published preference path only after a timed drill restores usable suppression inside the documented budget without an undocumented manual step.