update marketing consent

Author: tamalchowdhury

src/content/docs/integrate/third-party-tools/kinde-loops.mdx

@@ -178,9 +178,17 @@ Now that you have decoded the JWT, you can use the extracted data to add contact
    - **Last Name**: Map to the `Last Name` field from the Code step output
    - **Source**: Set to `kinde` or `zapier` (optional)
    - **Subscribed**: Set to `true` (default) to ensure users receive emails
-   - **User Group**: Map to the `Org Code` field from the Code step output (useful for segmentation by user or audience groups)
-   - **User ID**: Map to the `User ID` field from the Code step output (useful for syncing with Kinde)
-   - **Mailing list**: Add the user to a mailing list in Loops. Enter the list ID you copied from Step 1 and set the value to `true`
+
+    <Aside title="Marketing consent">
+      Setting `subscribed` to `true` automatically opts users into marketing emails. Under GDPR and CAN-SPAM regulations, explicit consent is typically required before sending marketing communications.
+
+      **Best practices:**
+      - Add clear consent language at signup (e.g., "I agree to receive marketing emails") and only set `subscribed` to `true` if the user explicitly consents
+      - Alternatively, default `subscribed` to `false` and implement a double opt-in flow where users confirm their email address before receiving marketing emails
+      - Log and store the user's consent timestamp and source (e.g., "signup_form", "profile_settings") for auditability and compliance purposes
+
+      If the user doesn't consent, set `subscribed` to `false`.
+    </Aside>
 
 6. Select **Continue**
 7. Select **Test step** to verify the contact is created in Loops