1. Separate the channels
Permission to email is not permission to text. A phone is a more intimate device and the expectation attached to it is different. Ask for each channel on its own line, and never infer one from the other.
2. Say what you will send
Vague consent produces resentment later. Name the content: formation prompts, session invitations, field year updates. Name the rhythm. Name the exit.
3. Keep a ledger, not a memory
Record every grant and withdrawal as an event with a timestamp, a channel, and a source. A ledger answers the only question that matters in a dispute: at the moment this message was sent, what permission existed?
It also lets you replay a blocked message honestly. If someone re-grants permission, the previously blocked message can be released; if they did not, it stays blocked and the reason is on the record.
4. Withdrawal must reach the future
Most failures happen here. A person opts out and the messages keep coming because they were already queued. Opting out must cancel everything still scheduled, not merely stop the next enrollment.
5. Make the record exportable
Board members, insurers, and partner institutions may all ask. An export that shows the message, the recipient, the queue state, the current consent, the reason anything was blocked, and any replay attempt turns a stressful question into a two minute answer.