How Do I Keep Records of Customer Consent to Text, Call, and Email?

By Bill Stilwell · Last reviewed October 17, 2026

The short answer

For every person you email, text, or call for marketing, keep a record of where they agreed, when, the exact words they saw, which channels they agreed to, and when they opted out. Keep a do-not-contact list that every tool checks, and write down which vendor handles which part. If someone challenges you, these records are your proof.

Why it matters

Federal rules set consent and opt-out requirements, and states can add more. Under FCC rules, automated marketing texts and calls to cell phones need prior express written consent, which must include the person’s phone number and say that agreeing isn’t a condition of buying. The FTC’s CAN-SPAM Act guide says you must honor an email opt-out within 10 business days and keep your opt-out method working for at least 30 days after you send a message. Without records, you can’t show you followed any of it.

What it means: where the person agreed, like a website form, booking page, paper intake form, or a text keyword.

How to do it: add a “consent source” field to each contact, with set choices like “Website quote form” or “In person intake.” Use the same choices every time.

Common mistake: assuming someone who called for a quote agreed to marketing.

What it means: the date and time the person agreed.

How to do it: let your form or tool stamp it automatically. For paper forms, enter the date from the form, not the date you typed it in.

Common mistake: a blank date on contacts imported from an old list.

What it means: the exact words the person saw when they agreed.

How to do it: save a copy or screenshot of each version of your consent wording with the dates it was used. Link each contact to the version they saw.

Common mistake: changing the form wording and losing the old version.

12.6.4 Communication type

What it means: which channels and kinds of messages the consent covers: email, texts, calls, or automated messages, and service or marketing.

How to do it: use separate checkboxes or fields for each channel and type. Service texts and marketing texts are different permissions (see 12.5.1 Customer Service Texts and 18.4 Text Message Marketing Rules).

Common mistake: one “Okay to contact” box used for everything.

12.6.5 Opt-out

What it means: the date, method, and systems updated when someone says stop.

How to do it: record when and how they opted out (STOP reply, unsubscribe link, phone call, email) and which tools you updated. Honor opt-outs fast. FCC rules list reply words like STOP, QUIT, END, REVOKE, OPT OUT, CANCEL, and UNSUBSCRIBE as clear requests. CAN-SPAM allows up to 10 business days for email. The FCC’s opt-out rules have changed several times in 2024 to 2026, so check the current version with your attorney.

Common mistake: updating the email tool but not the texting tool.

12.6.6 Suppression list

What it means: a do-not-contact list every system checks before sending.

How to do it: keep one master list of people who opted out or should never be contacted. Load it into every email, text, and calling tool. FCC rules on company do-not-call lists for telemarketing say to honor a request within 10 business days and keep honoring it for 5 years. Never delete someone from this list during a cleanup.

Common mistake: a fresh import that adds back people who opted out.

12.6.7 Vendor responsibility

What it means: writing down which company captures, stores, and honors consent.

How to do it: for each tool (form builder, customer records system, email tool, texting tool), note who collects consent, where it’s stored, and who processes opt-outs. Check that your contracts cover it (see 11.2.7 Data-Processing Terms). The business is still responsible even when a vendor sends the message.

Common mistake: assuming the vendor handles compliance for you.

Each contact record in your customer records system should hold the consent fields above: source, date, language version, channels, and opt-out status. See 15.3 Contact and Company Records for the rest of the record.

When you import contacts, bring the consent and opt-out fields with them. If a list has no consent history, treat those contacts as not consented for marketing until you have proof. See 15.5 Importing and Cleaning Records.

Ask for consent at intake, on the form or during the first call, with clear checkboxes for each channel. Don’t pre-check the boxes. See 16.1 Lead Intake.

When to get help from a pro

An attorney who handles consumer communications law can review your consent wording and process. Questions to ask:

Does my consent wording meet federal and state rules for texts and calls?
How should I handle contacts with no consent record?
How long should I keep consent and opt-out records?

Bill’s note

[Bill: add a short note. For example, how you set up consent checkboxes on client forms, or a client who had to rebuild their list because they had no consent records.]

How I did this for SiteSmarty

[Date I did this:]
[What I actually did, step by step: SiteSmarty’s consent fields, wording versions, and suppression list]
[What it cost and how long it took:]
[What surprised me or what I’d do differently:]
[Screenshot or photo to add, with private info blurred: a contact record’s consent fields and the saved consent wording]
[Result so far:]

Questions people ask

How do I prove a customer agreed to texts? Keep the source, date and time, the exact wording they saw, the channels they agreed to, and their phone number.

How fast do I have to honor an opt-out? For email, the FTC’s CAN-SPAM guide says within 10 business days. For texts and calls, honor it as fast as you can and check current FCC rules.

What is a suppression list? One list of people who must not be contacted, loaded into every tool you send from.

Is the vendor responsible for consent? Your business is still responsible. Write down who does what and check your contracts.

Audit check

Outline line	Question	Pass looks like	Fail looks like	Evidence to collect
12.6.1 Consent source	Is the source recorded for each contact?	Standard source field filled in	Blank or guessed sources	Sample contact records
12.6.2 Consent date	Is the date and time recorded?	Automatic timestamps	Missing dates on imports	Sample records
12.6.3 Consent language	Is the exact wording saved for each version?	Dated copies of each version	Old wording lost	Saved wording versions
12.6.4 Communication type	Is consent recorded by channel and type?	Separate fields for email, text, calls, marketing	One catch-all box	Form and record fields
12.6.5 Opt-out	Are opt-outs recorded and honored in every tool?	Date, method, systems updated	Opted out in one tool only	Opt-out log
12.6.6 Suppression list	Does every tool check one do-not-contact list?	Master list loaded everywhere	Imports re-add opted-out people	List and tool settings
12.6.7 Vendor responsibility	Is it written who captures, stores, and honors consent?	Table of tools and roles, contracts checked	“The vendor handles it”	Vendor table and contracts
15.3.4 Consent	Do contact records hold consent fields?	Fields present and filled	No consent fields	Record layout
15.5.5 Consent status	Did imports keep consent and opt-out data?	Consent fields mapped on import	Consent lost in import	Import log
16.1.8 Consent	Does intake ask for consent by channel?	Unchecked boxes per channel	Pre-checked or missing boxes	Intake form screenshot

Where this fits

Do this first: 11.5 Data Map, 12.5.1 Customer Service Texts

Do this next: 12.7 Testing Communication Channels

Sources

Electronic Code of Federal Regulations, 47 CFR 64.1200, Delivery restrictions (checked October 17, 2026)
Federal Register, "Strengthening the Ability of Consumers To Stop Robocalls" (checked October 17, 2026)
Federal Trade Commission, "CAN-SPAM Act: A Compliance Guide for Business" (checked October 17, 2026)

This page explains general rules and Bill's own experience. It is not legal, tax, or insurance advice. Talk to a qualified professional about your situation.

How Do I Keep Records of Customer Consent to Text, Call, and Email?

The short answer

Why it matters

12.6.1 Consent source

12.6.2 Consent date

12.6.3 Consent language