Marketing consent capture and change

How do we capture marketing consent at signup or on a change with its wording and time, and write it to the marketing system so every channel honors it?

Record consent as evidence, not a checkbox. At signup, at checkout, on a preference change or on an opt-out, Callvu prefills the customer's current preferences from the marketing system, presents the consent choices the law for the customer's location requires (separate, unticked choices by channel: email, text, calls, postal, and by purpose where required), with the exact wording shown, captures the choice with the time, the channel, the wording version and the proof of the action (the double opt-in for email where used, the keyword or the form for texts, the recording for a call), applies the rules (an opt-out honored within the period across every channel, a text consent that is prior express written consent, a transactional message that needs no consent, a withdrawal as easy as the grant), routes a conflict or an unusual request to the marketing compliance desk in the Decision Desk, and writes the consent record to the marketing system, the system of record, which every sending system reads before a message goes out.

In scopeSimpleCallvu moves: prefill, write back

Talk to an expert Try it in the sandbox

Last updated November 7, 2026.

The problem today

The customer opted out on the website, kept receiving texts from a campaign tool that had its own list, and the complaint came with a lawyer's letter.

Today, without Callvu

Marketing consent lives in five places: the signup form, the checkout checkbox, the email platform, the text platform, the call center's dialer. Each has its own record, none has the wording the customer saw, and an opt-out in one does not reach the others. The text that goes out after an opt-out is a statutory claim; the email without a working unsubscribe is a fine; the consent nobody can produce is no consent.

The rules are specific: the TCPA requires prior express written consent for marketing texts and autodialed calls with disclosures and a clear opt-out mechanism; CAN-SPAM requires a working opt-out honored within ten business days and no sender misrepresentation; GDPR and the state laws require consent that is freely given, specific, informed and unambiguous, as easy to withdraw as to give, with the evidence kept. One consent record per customer per channel and purpose, with the wording and the time, read by every sender before every message, is the whole answer.

Consent the business can produce is consent it can use; consent it cannot is a liability wearing a list.

How it runs

From the requestto the system of record.

A customer signs up, checks out, changes their preferences, replies to a keyword, or opts out in any channel. Callvu opens the consent event with the customer's record.

Customer: Makes the choices on a clear screen or by the channel's action, and can change them as easily.
Marketing compliance desk: Decides conflicts and unusual requests in the Decision Desk.
Sending systems: Read the consent record before every message.
Callvu: Prefills, presents the right choices, captures the evidence, applies the rules, routes and writes.

Prefill and present the choices
The customer's current consents and the applicable law from their location are prefilled; the choices are presented as the law requires (separate, unticked boxes by channel and by purpose where the law requires purpose-level consent, the wording with the sender, the message types, the frequency, the costs for texts, how to opt out, and the privacy notice link), with the current state shown so a change is a change.
Capture the evidence
The choice is captured with the time, the channel, the page or the form, the wording version shown, the customer's identifier and the proof the channel requires: the double opt-in confirmation for email where the policy or the law uses it, the keyword reply or the form submission with the disclosure for texts, the recorded statement for a call; an opt-out captured in any channel (an unsubscribe link, a stop keyword, a verbal request, a reply) is captured the same way.
Apply the rules and decide
The rules run: a marketing text consent must meet the prior express written consent standard with the disclosures, a transactional message needs no consent and is classified as such, an opt-out is honored across every channel for the purpose within the period, a withdrawal is applied immediately in the marketing system and the sending systems, a child's data is not marketed to; a conflict (an opt-in and an opt-out at the same time, a consent from a third party source without the evidence, a request to re-consent a lapsed list) goes to the marketing compliance desk in the Decision Desk with the record and only the allowed outcomes (apply the most protective choice, request the evidence, or refuse the use).
Write back
The consent record is written to the marketing system, the system of record, as the current state per channel and purpose with the full history, every sending system reads it before a message goes out (and the dialer and the campaign tools are fed the opt-outs), the customer receives the confirmation of the change where the channel allows, and the record is retained for the evidence period.

Where it ends: Every consent and every opt-out was captured with the wording, the time and the proof, applied across every channel by rule, and written to the single record the senders read before every message, so the business can produce the consent and never sends against an opt-out. The Decision Trace shows the choices presented, the rules applied and any decision; the Audit Trace shows each capture and each write with time.

Runtime enforcement

What is enforcedwhile the work runs.

The regulations preloaded in Callvu Studio and the bank's own policies, applied as steps that run, not lines in a binder. A step that breaks a rule does not run, so a completed run was compliant.

Regulations

TCPA: The Telephone Consumer Protection Act (47 USC 227) and the FCC rules at 47 CFR 64.1200 require prior express written consent for marketing calls and texts made with an automatic telephone dialing system or an artificial or prerecorded voice to a mobile number, with a clear disclosure that the consumer agrees to receive such messages and that consent is not a condition of purchase; the consumer may revoke consent by any reasonable means and the revocation must be honored within the period the rules set; the do-not-call rules and the quiet hours apply; and the private right of action carries statutory damages per message.
CAN-SPAM: The CAN-SPAM Act (15 USC 7701 to 7713) and the FTC rule at 16 CFR 316 require commercial email to carry accurate header and sender information, a non-deceptive subject line, an identification as an advertisement where required, a valid physical address, and a clear and conspicuous opt-out mechanism that works for at least thirty days after sending and is honored within ten business days, with no fee, no additional information and no further conditions; the sender may not sell or transfer the opted-out address.
GDPR: Consent under the General Data Protection Regulation (Articles 4(11) and 7, and the ePrivacy rules for direct marketing) must be freely given, specific, informed and unambiguous by a clear affirmative action, with separate consent for separate purposes, no pre-ticked boxes, the controller able to demonstrate the consent, and withdrawal as easy as the grant with the data subject informed of it beforehand; the state privacy laws add opt-out rights for the sale and sharing of personal data and honor universal opt-out signals.

Company policies

Consent is captured per channel and purpose with the wording version, the time and the proof; a checkbox without evidence is not consent.
Marketing texts and autodialed calls require the written consent standard with the disclosures; transactional messages are classified as such.
An opt-out in any channel is honored across every channel for the purpose, within the period, and withdrawal is as easy as the grant.
The marketing system is the system of record, and every sending system reads it before sending.

Controls

Law-based choice presentation with separate unticked boxes.
Evidence capture with wording version, time and channel proof.
Written consent standard and transactional classification.
Cross-channel opt-out application within the period.
Decision Desk for conflicts.
Marketing system write read by all senders, with retention.

Clocks and deadlines

Email opt-out: Honored within ten business days under CAN-SPAM; the link works for at least thirty days.
Text and call revocation: Honored within the FCC's period after a revocation by any reasonable means.
Consent evidence retention: The policy's period after the last use, long enough to answer a claim.

Documents and checks

The choices presented with the wording version
The consent or opt-out captured with the proof
The rules applied and any decision
The marketing system record and its history

In the Decision Trace

The law and the choices presented.
The rules applied and any decision with the person.

In the Audit Trace

Each capture with time, channel and proof.
Each write and each sender's read.

The handoff

Between the front doorand the back office.

The front door

Signup, checkout, the preference center, a keyword reply, an unsubscribe link, or a request in any channel.

The back office

The marketing compliance desk decides only conflicts; the senders never see a list that is not the record.

The Decision Desk

A simultaneous opt-in and opt-out, a third-party consent without evidence or a request to re-consent a lapsed list goes to the marketing compliance desk in the Decision Desk with the record and only apply the most protective choice, request the evidence, or refuse the use.

Proof

In scope.Proof at scale, not one process at a time.

The kind of process Callvu runs in production for customers in this industry. Ask for a reference on this exact process. The results below are the industry's published proof; each claim code links to its record on agents.callvu.com.

More than 1,000 processes are live across Callvu customers.

Across Callvu customers

Questions

What buyers ask next,answered plainly.

What is recorded with a consent?

The channel and the purpose, the exact wording version shown, the time, the page or form, the customer's identifier and the proof the channel requires (the double opt-in, the keyword reply with the disclosure, the recorded statement).

How is an opt-out handled?

Captured in any channel, applied across every channel for the purpose within the legal period, and written to the marketing system that every sender reads before a message goes out.

What consent do marketing texts need?

Prior express written consent under the TCPA with the disclosures, including that consent is not a condition of purchase, and an opt-out by any reasonable means.

Related processes

Privacy access and deletion request Product registration Account recovery and takeover Try it in the sandbox All travel and ecommerce processes

Bring this process, or the one that costs you most.

We build it against your policies and your systems, train your team and stay with you through launch. You are live in weeks.