Consent-Proof-First Messaging: Tenant-Owned Controls for 2026

Quick answer: Consent-proof-first messaging flips the usual order of operations — instead of sending first and reconstructing evidence when a carrier, regulator, or plaintiff asks, you treat the consent record as a first-class asset that has to exist before a message leaves the account. On Orbit the asset lives in tenant-owned controls: the consent ledger you browse in Audience → Consent and Audience → Opt-outs, the opt-out keyword sets in Settings → Compliance → Opt-out Lists, and the proof exports in Settings → Compliance → Documents and Settings → Compliance → Binder. None of it makes your program compliant — it makes your program provable on the evidence your tenant configures and owns. This post defines what a consent record must hold, how to true it up, what to export for counsel, the quarterly rhythm it slots into, and sample disclosure language per channel.

The full endpoint-level references live in the Compliance docs section. This post is the operating argument: why consent runs as an asset, not as a byproduct of campaign traffic.

Why "proof-first" is the 2026 baseline

Three pressures moved messaging consent from a launch-time checkbox to a standing asset:

• Carriers gate on evidence, not intent. US A2P 10DLC campaign reviews routinely ask how opt-in was captured; Meta pauses WhatsApp templates over complaint rates; RCS agents go through per-brand carrier review. In each case, the operator that answers from a ledger ships; the operator that answers from memory rebuilds the evidence under a deadline.
• Revocation parity is now a litigated question. The FCC's TCPA rulemaking codified that a revocation arriving by any reasonable means binds every channel the grant covered. An SMS STOP that never reaches your voice program is not a policy gap — it is the exhibit. Orbit's ledger collapses entry points into one grant/revoke trail precisely so parity comes from construction rather than policy documents.
• DSAR clocks are short. GDPR gives 30 days, Brazil's LGPD gives 15. A consent trail you cannot export quickly is a consent trail that fails its first real test. The DSAR surface exists because discovery is not the moment to learn your pipeline is unexercised.

Proof-first means: before a campaign launches, every recipient slice has consent records whose fields would survive a subpoena, and the export path has been walked at least once. The sections below define the record, the true-up, the counsel handoff, the cadence, and the language.

What a consent record must hold

A consent record that only stores "this contact opted in" answers the easy question. Audits ask the hard ones — when, from where, under what language, for which channels, under which regime. On Orbit, each row in the consent ledger carries the fields that decide discoverability, and they are the same fields you inspect in Audience → Consent and export from the Consent API:

1. Timestamp. granted_at / revoked_at, down to the millisecond. The grant instant and the no-send-after instant — and on re-permission, the original grant timestamp is preserved while the proof refreshes. A record without a timestamp is a claim, not evidence.
2. Source channel and capture method. source records how the grant arrived — a web form, a CSV import, a keyword, an API write — alongside the channel it applies to (sms, whatsapp, email, voice, rcs, and the rest of the channel set). An imported spreadsheet row and a live form capture are different evidence tiers, and the record should say which it is.
3. Scope. Which channels the grant (or revocation) covers. This is where parity becomes concrete: a keyword STOP on a phone number writes revocation at scope all — every channel the number can reach — while an email unsubscribe scopes to email. Scope is the field a discovery request probes first.
4. The consent language version. consent_text_version — which version of the disclosure text the person agreed to. When your copy changes, records captured under the old version stay provable for what they said, and new captures need the new version. Sample disclosure texts per channel appear below.
5. Lawful basis and jurisdiction context. lawful_basis records the GDPR Article 6 basis (consent, contract, legitimate interest, and the others); purpose describes the use in plain language. The jurisdiction a program runs under is a tenant-side determination — the ledger stores the basis you assert; deciding which regime applies stays with you and your counsel.
6. Proof pointer and expiry. consent_proof_url links the screenshot or signed document; valid_until or expires_in_days makes the grant time-bounded where re-confirmation windows apply, and the expiring-consent endpoint sweeps for grants that need re-permission.

Six fields, all inspectable per contact in Audience → Consent, all exportable, all written by the tenant's own capture paths. Orbit stores and timestamps them; it does not adjudicate their sufficiency — the platform records; it does not adjudicate.

Crafting the loop: true up evidence, not inventory

The destination of every consent write is one ledger, and every read surface draws from it. In the dashboard: Audience → Consent is the per-contact inspector — type a contact, see every active grant and revocation with channel, source, policy template, and lawful basis, and preview the delivery verdict for a channel before you send. Audience → Opt-outs is the suppression mirror — per-channel suppression plus consent receipts, the same ledger read from the opt-out side. Settings → Compliance → Opt-out Lists defines the keyword sets (STOP / HELP / START and auto-response copy) attached to your messaging services, so inbound revocations are captured in your SMS program's own vocabulary.

Truing up means reconciling the ledger against three drift sources:

• Old imports. A 12,000-recipient CSV from two platforms ago may be the only consent proof for current traffic. Records with source: import and a stale consent_text_version are exactly that — re-capture through the live path (POST /compliance/consent, or the double-opt-in handshake when the evidence tier needs a recorded recipient reply) so each row carries the current language version and a proof pointer.
• Unrecorded capture paths. A landing form or a checkout checkbox that never writes to the ledger leaves the compliance-health consent-coverage factor sliding — recipientsContacted rising while recipientsWithConsent lags. The fix is a write to the Consent API at capture time, not a patch on the score.
• Revocations stuck on one channel. Verbal objections on calls, unsubscribe clicks, STOP keywords — all of them must land on the same grant. Wrap voice programs with a disposition-to-consent write (opt_in: false), and let the keyword and one-click paths record natively. Parity holds when no entry point is bespoke.

The operational slogan: send gates read the ledger; the ledger is owned by you. Orbit enforces what you configure and defaults open — nothing gates a send you have not chosen to gate.

Exporting for counsel: documents and binder

When counsel, a procurement team, or a regulator asks, two exports do the talking:

• The consent proof-of-record. GET /compliance/consent/export downloads the tenant-wide trail — every grant and revocation — as CSV or JSON, filterable by channel, state, contact, and date range. The suppression export alongside it preserves revoked rows, so the file proves re-permissioning, not just the active blocklist. Archive both per campaign and per quarter: a proof export from January answers a January audit.
• The document library and evidence binder. Settings → Compliance → Documents is the tenant document library — upload carrier- or procurement-facing documents once and reuse them across compliance profiles (KYC forms, sender registrations, the disclosure templates your consent rows reference). Settings → Compliance → Binder generates the one-click evidence pack that maps a quarter of your own posture data — consent coverage, retention configuration, audit-log volume — onto SOC 2, ISO 27001, GDPR, or HIPAA control matrices, with a SHA-256 checksum on the artifact. It assembles what your tenant produced; it is tenant-generated evidence, not a Devotel attestation.

Both are deliberately boring machinery. The discipline is in when you run them — which is the quarterly rhythm.

The quarterly rhythm: plug into the standing review

This post is the asset argument; the cadence that keeps the asset true already has its own playbook — Compliance Posture Is a Quarterly Discipline, Not a Launch Checklist. Consent is check 1 of that four-check loop (consent drift), and proof-first messaging adds nothing to it — it feeds it:

• Per campaign: before launch, export the recipient slice and confirm the coverage matches the traffic; after launch, the same export becomes the campaign's evidence file.
• Per quarter: run the standing review — read the coverage factor, re-capture stale rows, exercise the DSAR export once, generate the binder. The asset stays current because the cadence owns it.

Consent work that lives outside the quarterly loop ages invisibly. Plug it in; let the calendar carry the posture.

Sample disclosure language per channel

Starting points, not legal advice — run final language past counsel, and record the version you ship as consent_text_version on every grant.

SMS (form checkbox, 10DLC-friendly):

> ☐ By checking this box and submitting, you agree to receive recurring automated marketing text messages from {{Brand}} at the number provided. Consent is not a condition of purchase. Message and data rates may apply. Reply STOP to opt out, HELP for help. {{Brand}} Privacy Policy and Terms apply.

The checkbox is separate from terms-and-conditions acceptance, is unticked by default, and the phone number field names the use. Record the capture with source: web_form and the language version of the copy rendered with it.

RCS opt-in:

> ☐ Send me order updates and offers on Google Messages (RCS) instead of SMS. Message frequency varies. You can revoke at any time by replying STOP. Standard messaging rates may apply.

RCS programs inherit each carrier's agent-review expectations; the disclosure should name the channel explicitly rather than folding RCS into an SMS consent, so the scope of the grant is unambiguous in the ledger.

Voice (two-party-consent announcement, opening of a recorded call):

> "This call is being recorded, and both parties are notified. If you do not consent, let us know now and we will continue unrecorded."

Pair the announcement with the per-organization recording settings (consent_announcement_mode: announce_all for all-party jurisdictions) — the mode decides who hears the notice; the disclosure above is the notice. The companion explainer, Call Recording Consent Rules in 2026, walks the jurisdiction matrix.

Tenant-owned, never platform-adjudicated

Every surface named above is tenant-owned configuration. Orbit provides the consent ledger and its proof exports, the send-time gates (all tenant-configured, default-open), the revocation parity mechanics, the document library, and the binder generator. What it does not provide is the legal answer: which obligations bind your traffic, whether your disclosure language suffices, whether a grant was validly obtained. The platform records; it does not adjudicate. The controls make your posture provable — the posture itself, and its sufficiency, belong to you and your counsel. None of this is legal advice.

Frequently asked questions

Does recording consent in Orbit make a send compliant?

No. Recording consent creates an auditable trail and feeds the send-time gates you configure — it does not establish that consent was validly obtained, and it does not make a message lawful. Validity of the capture, sufficiency of the language, and the jurisdiction analysis stay with you; Orbit stores and enforces what you record, nothing more.

Orbit ships defaults-open — could a campaign send to contacts with no consent record?

Yes, unless you gate it — and that is intentional. Send-time gates (quiet hours, suppression, DNC pre-flight) ship off or empty; Orbit enforces what you turn on and never mandates a posture. Proof-first messaging is the argument for turning the consent gate on for marketing traffic deliberately, at launch, rather than after the first carrier question.

When do I need the double-opt-in handshake instead of a plain consent write?

Use double opt-in when the evidence tier demands a recorded recipient reply — TCPA express written consent, EU confirmed opt-in, some 10DLC campaign reviews. A plain POST asserts the grant the moment your surface obtained it; the handshake adds a pending-then-confirmed cycle that captures the recipient's affirmative answer as part of the record.

How does revocation parity work across channels?

A revocation asserting scope all — a keyword STOP on a phone number, an API opt_in: false on an E.164 identifier — fences every channel that address can reach, in one ledger write. Channel-scoped revocations (email unsubscribe, a channel-filtered import) fence only that channel. The audit trail (GET /compliance/consent/history) shows both shapes side by side, which is exactly what a discovery request reads.

What should counsel receive on a consent inquiry?

Three artifacts: the consent export filtered to the relevant contact/date range (grants and revocations with timestamps, source, language version, and proof pointer), the matching suppression export showing the fence was honored, and — where the question is broader — a binder generation mapping the quarter onto the relevant framework. All three are tenant-generated from your own data; none is a Devotel attestation.

The takeaway

Consent-proof-first is a sequencing decision: the record comes first, the campaign second, and the export is walked before anyone asks for it. Orbit's part is deliberately narrow — one ledger, tenant-owned surfaces to inspect it, exports and binders to prove it, and parity built into the revocation write. Run it per campaign, review it per quarter, and keep the legal determinations where they belong: with you.