Consent records with timestamp, source, method per subscriber

GDPR Art. 7(1) requires that the controller 'be able to demonstrate that the data subject has consented.' TCPA §227 litigation regularly turns on whether the sender can produce a consent record for a specific number. CASL Section 13 requires that senders keep consent records for 3 years after the last commercial message. CWE-778 (Insufficient Logging) captures the technical gap: without a timestamped, source-tagged consent log, you cannot respond to a regulator's demand for proof of consent, a court's discovery request, or a user's GDPR access request. A marketingOptIn: true boolean with no supporting record is legally worthless.

Add a dedicated consent audit table that records every opt-in and opt-out action with full provenance — never rely on a boolean flag alone.

-- Migration: consent audit trail
CREATE TABLE marketing_consent_log (
  id               UUID PRIMARY KEY DEFAULT gen_random_uuid(),
  subscriber_id    UUID NOT NULL REFERENCES subscribers(id),
  channel          TEXT NOT NULL CHECK (channel IN ('email', 'sms')),
  action           TEXT NOT NULL CHECK (action IN ('opt-in', 'opt-out', 're-opt-in')),
  method           TEXT NOT NULL, -- 'double-opt-in', 'single-opt-in', 'sms-keyword'
  source           TEXT NOT NULL, -- 'signup-form', 'checkout', 'preferences-page'
  language_version TEXT,          -- 'v1-2026-01' — version of consent text shown
  ip_address       INET,
  created_at       TIMESTAMPTZ NOT NULL DEFAULT now()
);

Write a row for every opt-in and opt-out action. Retain records for the subscriber relationship duration plus 3 years (CASL minimum). Do not delete consent records when users unsubscribe — the opt-out record is itself evidence.