Keeping purchased leads out of Marketo until they opt in
I'm working through a scenario dealing with preventing purchased leads from flowing down into Marketo UNTIL they opt-in naturally. Our sales team acquires leads and imports them directly into Salesforce, I believe as contacts, and in order to maintain compliance, we mark them in a way that prevents them from syncing down into Marketo. However, we want it to be set in a way so that if John Doe was originally purchased, then converts naturally on our website, he will flow up from Marketo into Salesforce and merge with the original purchased profile (thereby maintaining both any sales-related activity as well as the Marketo activity).
In my head, the only way to possibly do this, without manual effort, would be via an apex trigger on the Salesforce side -- essentially a de-dupper. When John Doe's new lead comes into Salesforce, the trigger would query his email against all contacts with Purchased = True. If there's a match, the trigger would merge the records on the spot and change Purchased = False. This way they would be merged and could now sync freely between the two.
Has anyone else dealt with this -- and if so, did you find a different solution?